Skip to main content

Documentation Index

Fetch the complete documentation index at: https://help-plum.xoxoday.com/llms.txt

Use this file to discover all available pages before exploring further.

All requests to the Xoxoday Rewards API must be authenticated. Xoxoday uses bearer authentication, where each request must include an HTTP header that includes your Client ID, Secret ID, and Access Token. The following guide explains how to generate your client ID, secret ID, and access tokens from the admin portal.

​
How to Generate Your API Key

​
Generate API Tokens

  1. Log in to your Xoxoday Admin Dashboard (Sandbox or Production).
  2. Go to Settings → API.
  3. Under the Storefront Integration tab, click Generate New Tokens.
  4. A pop-up will appear showing the scope of integration. Click Save.
  5. Your Client ID and Secret ID will now be visible on the dashboard — copy and store them securely.
  6. Click on Generate New Tokens.
  7. Confirm by clicking Yes, Generate.
  8. Your Access & Refresh Tokens will be displayed — copy them immediately, as they will not be shown again.
  9. Treat these tokens like a password. Keep them secure and never expose them publicly.

​
Using the API Key

To authenticate your API requests, include the access token in the Authorization header as a Bearer token: 
Authorization: Bearer <your-access-token>
This header is required for all authenticated API calls to both sandbox and production environments.
Ensure that your token is kept secure and never exposed in client-side code or public repositories.