Settings: API and webhooks
Two directions. A token lets a store, a bot or a script call Atlas. A webhook makes Atlas call your server or a Discord channel.
Open it now:Settings, API and webhooks
What this tab is for
Your own program does not use a token: it signs in with the API key from SDK and key. Tokens are for other tools that run your application for you, such as handing out a key after a sale or banning a buyer after a chargeback. What each address does is in Stores and the API.
| Part of the tab | Who can use it |
|---|---|
| API tokens | Only the owner of the application. A reseller or staff member does not see them. |
| Webhooks | The owner, and any reseller with the webhooks permission. On the free plan, adding, changing, testing and deleting a webhook also needs your Discord account linked and the Verified Member role. |
Create a token
New token opens three steps.
- Name it. For you only, such as
sellauth-deliveryorchargeback-webhook(80 characters at most). Storefront auto-delivery is on by default; turn it off for a token that only bans, resets or reads. - Set it up. With auto-delivery on you set what each delivered key looks like: the mask, the validity (days, weeks, months or years; 0 is a lifetime key), the level (1 to 100), a note, and whether to skip look-alike characters (0, O, I, l, 1). Without it you tick the actions the token may do.
- Review and create.
A delivery token carries only the license.generate scope, because its address is pasted into a store. Open Edit to give it more.
Use a token
Under the intro card, pick which token the addresses on the page are built from, then choose the job. The page shows only that job's addresses, with your token filled in.
| Job | Shows |
|---|---|
| Deliver keys after a sale | A key address builder (count, mask, validity, level, note, character set, look-alike characters) that writes the address as you change it, as a plain address or an address plus a JSON body. The address needs a token with license.generate; the builder says so when it lacks it. |
| Ban on a chargeback | The ban and unban addresses with a body to send. |
| Run support from a console | Reset, extend, pause, resume, look up and kick addresses. |
| Write my own script | Setup walkthroughs for Sellauth, Sellix, Sellpass, Shoppy, Zapier or Make and a Discord bot, plus Node.js, Python and PHP code. |
An address whose action the token does not have the scope for is greyed out; open Edit and tick the scope. The page cannot show a token's secret again, so it fills YOUR_TOKEN until you paste the token into Your token. That field is remembered for this browser tab only and is never sent to a server. A token you just created or rotated is filled in for you.
Look after a token
All tokens lists every token with its name, atlas_ik_ and the last four characters, calls per minute and hour, calls in the last 24 hours, when it was created and when it was last used.
| Action | Does |
|---|---|
| Activity | The last 200 calls: status, method, path, error code, time taken and age. Filter to all, successes or errors. |
| Edit | Changes the name, the auto-delivery preset, the scopes, the rate limits and the IP allowlist. |
| Rotate | Makes a new secret and invalidates the old one at once. Every tool that holds the old address must be updated. Active tokens only. |
| Revoke | Stops the token working at once. Its activity stays readable. |
| Delete | Appears on a revoked token and removes it. What it did stays in the application's audit record. |
| Setting | Rule |
|---|---|
| Rate limit | Calls per minute (1 to 6,000) and per hour (up to 360,000, never below the per-minute figure). A new token starts at 60 and 3,600. Over the limit the call is refused with a wait time. |
| IP allowlist | Up to 32 addresses or ranges, separated by commas, such as 203.0.113.7 or 203.0.113.0/24. Empty accepts any address. Set it to the store's published addresses so a leaked delivery address cannot be used from elsewhere. |
| Scopes | license.read, license.generate, license.ban, license.reset, license.pause, license.extend, license.delete, session.read, session.kick. Give a token only what its tool needs. |
Fifteen calls with an invalid token from one address in ten minutes block that address for ten minutes.
Webhooks: Atlas calls your tools
The Webhooks card sends the application's log events somewhere else. Add webhook asks for a kind, a name (for you only), an address, the events and whether it is on.
| Kind | Sends | Address |
|---|---|---|
| Discord channel | One embed per event: the message as the title, the license, hardware ID (first 24 characters) and IP as fields, and the event type in the footer. Not retried and not logged. | A Discord webhook address (Server Settings, Integrations, Webhooks, Copy Webhook URL). |
| Signed JSON | One signed POST per event, retried on failure, with a delivery log. | A public https:// address. Private addresses and addresses with a user name or password in them are refused. |
Events filters what a webhook receives: SUCCESS (a sign-in was accepted), DENY (refused), BAN (an alert rule banned someone), DISCONNECT (a session ended), WARN, ERROR, ADMIN (an admin action on a session or license) and LOG (a message sent by your client). Empty means every event, including any type not in that list. The toggle on each row mutes a webhook without losing its settings, and events are checked every 15 seconds.
| Button on a Signed JSON row | Does |
|---|---|
| Test | Sends a ping event now and shows the result. A test is not retried. |
| Log | The last 50 deliveries (kept 14 days): delivered, retrying or failed, the status code, time taken and attempts. Send again re-queues a delivery and sends it within 15 seconds. |
| New secret | Replaces the signing secret. The old one stops verifying at once. |
The signing secret (whsec_ and 48 characters) is shown once, when the webhook is created or its secret is replaced; afterwards only the last four characters are shown. A webhook that fails 20 deliveries in a row switches itself off and the row says why; turning it back on clears the count. The payload, the signature to verify and the retry schedule are in Webhooks. Post to Discord in an alert rule writes a WARN line to the logs, and that line reaches every webhook of this card, Discord and signed JSON, whose event filter accepts WARN.