> ## Documentation Index > Fetch the complete documentation index at: https://help-plum.xoxoday.com/llms.txt > Use this file to discover all available pages before exploring further. # Create Your API Key All requests to the Xoxoday Rewards API must be authenticated. Xoxoday uses bearer authentication, where each request must include an HTTP header that includes your Client ID, Secret ID, and Access Token. The following guide explains how to generate your client ID, secret ID, and access tokens from the admin portal. ## How to Generate Your API Key 1. Log in to your Xoxoday Admin Dashboard (Sandbox or Production). 2. Go to Settings → API Chat Screenshot Aug 6 2025 (2) \\ 3. Under the Storefront Integration tab, click Generate New Tokens.\\ Chat Screenshot Aug 25 2025 4. A pop-up will appear showing the scope of integration. Click Save.\\ Chat Screenshot Aug 25 2025 (1) 5. Your Client ID and Secret ID will now be visible on the dashboard — copy and store them securely. 6. Click on “Generate New Tokens”.\\ C569f48e9f3b1e610141d9e6646e3e47579106c09cf3f72f6eacb98607c0abcf Screenshot 2025 08 25 At 1 25 51 PM 7. Confirm by clicking “Yes, Generate”.\\ Chat Screenshot Aug 6 2025 (3) 8. Your Access & Refresh Tokens will be displayed — copy it immediately, as it will not be shown again.\\ Chat Plum & Perks Image (1) 9. Treat this token like a password. Keep it secure and never expose it publicly. ## Using the API Key To authenticate your API requests, include the access token in the Authorization header as a Bearer token: ```text theme={null} Authorization: Bearer ``` This header is required for all authenticated API calls to both sandbox and production environments. > Ensure that your token is kept secure and never exposed in client-side code or public repositories.