> ## Documentation Index
> Fetch the complete documentation index at: https://help-plum.xoxoday.com/llms.txt
> Use this file to discover all available pages before exploring further.
# Create Your API Key
Once you’ve received access to your sandbox or production account, follow these steps to generate your API key.
All requests to the Xoxoday Rewards API must be authenticated.
Xoxoday uses bearer authentication, where each request must include an HTTP header that includes your Client ID, Secret ID, and Access Token. The following guide explains how to generate your client ID, secret ID, and access tokens from the admin portal.
## How to Generate Your API Key
1. Log in to your Xoxoday Admin Dashboard (Sandbox or Production).
2. Go to Settings → API.\\
3. Under the Reward API tab, click Generate Client ID.
4. A pop-up will appear showing the scope of integration (Plum PRO API/Gift Card API). Click Save. Your Client ID and Secret ID will now be visible on the dashboard — copy and store them securely.\\
5. Click on “Generate New Tokens”.
6. Confirm by clicking “Yes, Generate”.
7. Your Access & Refresh Tokens will be displayed — copy it immediately, as it will not be shown again.
.png?fit=max&auto=format&n=jEpA9_WPjJJ_2zB2&q=85&s=942471c1dd5e1407580f8588172cd2d0 "Chat Screenshot Aug 6 2025 (1)")
8. Treat this token like a password. Keep it secure and never expose it publicly.
## Using the API Key
To authenticate your API requests, include the access token in the Authorization header as a Bearer token:
```text theme={null}
Authorization: Bearer
```
This header is required for all authenticated API calls to both sandbox and production environments.
> Ensure that your token is kept secure and never exposed in client-side code or public repositories.