API keys and webhooks
Let your own server work with your shop — with keys only you make, permissions you choose, and every request logged.
Settings → Developers connects your own systems to your shop through the Tocler API — for example a server that creates orders with crypto payments, keeps your stock in step with a warehouse, or delivers services. It is part of Pro and higher plans.
| Tab | What you do there |
|---|---|
| Start here | The API’s address, a first request and the links to the developer docs. |
| API keys | Make a key with only the permissions your server needs, the addresses it may call from and how long it works; rotate or revoke it. |
| Webhooks | Add your server’s https address to be told when orders are made, paid, delivered or refunded and when stock runs low; test it, see every delivery, send one again. |
| Requests | Every call of the last 30 days: when, which key, which endpoint, the answer — never what was sent. |
Turn on 2-step login
In My account. Keys that can create orders and payments need it, and every key change asks for your code.
Make a key
API keys → Make a key: a name, the permissions, optionally the addresses of your server, how many days it works. Confirm with your password and code. Copy the key — it is shown once; Tocler keeps only a fingerprint of it.
Give it to your developer’s server
Only to the server — never in a web page, an app or an email. Tocler refuses calls from browsers.
Watch it
Each key shows when it was last used and from which country; Requests lists every call. You get an email for every new or revoked key and 14 days before a key expires.
Crypto payments from your own site
A key with Create orders and Tocler Pay payments lets your server make an order in your shop and take its payment with Tocler Pay. The order goes through your shop’s checkout, so it works exactly like an order in the shop: Tocler Pay’s addresses credit your Tocler Wallet minus Tocler’s fee (or your own approved addresses, with the fee added to fees owed). There is no way to take money for your shop outside an order.
If something goes wrong
- A key leaked: Revoke it at once (it stops immediately), then make a new one.
- Your server is down: webhooks are tried again for a day; after 15 failures in a row a webhook switches itself off — switch it on again once your server works, and Send again what was missed.
- Tocler can pause the API for everyone or stop one shop’s API; you see the reason on this page.