API keys

Create keys to connect your own tools to the VEXiON cards API, and control exactly what each one can do.

The Developer tab under Settings is where you connect your own software to VEXiON cards. It has up to three parts: API keys (this page), Webhooks and AI assistants. The AI assistants part appears only when it is available to your account. The Developer tab is available to admins.

API keys and webhooks are available on every plan except VEXiON cards ONE. On ONE the Developer tab is still there and offers you the upgrade instead of the tools.

An API key is a secret password for a program. Where you sign in to the dashboard with your email, your scripts, your website, or a partner’s system sign in to the VEXiON cards API with a key. Anything the API can do, a key can do, which is why each key only carries the permissions you give it.

Keys created here start with vxn_sk_. They are production keys and work against your live loyalty data straight away. A separate sandbox is provisioned on request: contact us and we create a sandbox organization with its own vxn_test_sk_ key, used against https://migration.api.vexioncards.one. We send you the sandbox address together with the test key. Treat every key from this tab as production.

Settings → Developer → API keys

​

Creating a key

1. Open the Developer tab

   Go to Settings → Developer and stay on the API keys tab.

2. Click Create key

   Give the key a Label, a name only you see, so you can tell your keys apart later (for example Production server, Zapier, or Accountant export). Use one key per system, never share a single key across several. A key needs a label and at least one scope.

3. Choose its scopes

   Tick the permissions this key needs, and nothing more (see Scopes below).

4. Agree to the API terms

   Tick the box confirming that, by creating a key, you agree to Articles 7 and 8 of the Terms of Service (Third Party Platforms and Public API) and to Annex 1 (DPA) for the data processed through the API. The link next to it opens the published text. Create key stays greyed out until this is ticked.

5. Copy the key, once

   Click Create key. The full key is shown one time only. Copy it and paste it into your system’s settings right away.

The key is shown once and can never be seen again. For your security we only store a scrambled version, so we cannot recover or re-display it. If you lose it, revoke that key and create a new one.

​

Scopes

Scopes are the individual permissions a key carries. They come in two kinds:

• Read access (...:read), the key can view that data.
• Write access (...:write / ...:send), the key can change or create that data.

Flip All permissions on to grant everything at once (a master key), or tick just the boxes you need. The golden rule is least privilege: a key that only exports customers should hold customers:read and nothing else, so a leaked key can do as little damage as possible.

Choosing scopes when creating a key

Scope	What it allows
customers:read	View customer profiles and balances
customers:write	Create, update, or delete customers
cards:read	View card details and balances
cards:write	Create, update, or delete cards
transactions:read	View transaction and reward history
transactions:write	Record new transactions
products:read	View products and their prices
products:write	Create or update products (no delete, retire a product with is_active=false)
custom_fields:read	View custom field definitions
custom_fields:write	Create, update, or delete custom fields
locations:read	View store locations
locations:write	Update store locations (no create or delete)
team_members:read	View team member details
team_members:write	Invite and update team members (no remove)
notifications:read	View sent notifications and their delivery status
notifications:send	Send push notifications to customers
webhooks:read	View webhook endpoints and delivery attempts
webhooks:manage	Create, update, and manage webhook endpoints
organization:read	View organization details, plan, and invoices

A key can only ever do what its scopes allow. If a request needs a permission the key does not hold, the API refuses it, so granting less is always safe.

​

Using a key

Send the key in the Authorization header on every request, as a Bearer token:

curl https://api.vexioncards.one/v1/customers \
  -H "Authorization: Bearer YOUR_API_KEY"

That is all it takes to authenticate. From there the API Reference covers everything you can do, start with the Quickstart, then see Pagination, Rate limits, Idempotency, and Errors.

​

Managing your keys

Each key in the table shows its label, a masked preview of the key, its scopes, its status, and when it was created.

Status	Meaning
Active	Working normally.
Paused	Temporarily switched off. Any request using it is refused.
Revoked	Switched off permanently. Any request using it is now refused.

​

Revoking a key

Open the ⋯ menu on a key and choose Revoke when a key is no longer used, may have leaked, or belonged to a system you have retired.

Revoking cannot be undone, and every request using that key stops working within about 60 seconds. If a system still needs access, create a fresh key for it first, then revoke the old one.

​

Next steps

Set up webhooks

Get a signed message the moment something happens, instead of polling for changes.

API Reference

Full documentation of every endpoint, field, and response.