# Mint a 30 minute read-only token for one store POST /locations/{partner\_location\_id}/dashboard-token Select code sampleFetchcURL ```js const url = 'https://data.creatorain.com/partner/v1/locations/store_123/dashboard-token'; const options = {method: 'POST', headers: {Authorization: 'Bearer '}}; try { const response = await fetch(url, options); const data = await response.json(); console.log(data); } catch (error) { console.error(error); } ``` ```sh curl --request POST \ --url https://data.creatorain.com/partner/v1/locations/store_123/dashboard-token \ --header 'Authorization: Bearer ' ``` - Production (live stores; a live key is issued per partner) - Sandbox, for integration testing (test keys, test stores) Issues a credential whose entire authority is ONE store, for 30 minutes, read only. This is what makes the embedded merchant dashboard possible: the merchant’s browser holds this token and never your master key. Mint one when you render the embed. It cannot be refreshed and it cannot mint another one: this route requires the PARTNER KEY, so a leaked merchant URL expires rather than renewing. The token is accepted by the three `GET /locations/{partner_location_id}...` routes and nowhere else, as `Authorization: Bearer ` or `?token=`. `dashboard_url` is omitted when this deployment hosts no embedded dashboard. ## Authorizations - **[partnerApiKey](/partner-api/reference/#partnerapikey)** ## Parameters ### Path Parameters **partner\_location\_id** required string <= 200 characters YOUR id for the store, as you sent it to `POST /locations`. #### Example ``` store_123 ``` ## Responses ### 200 A fresh token. Media typeapplication/json object **token** required A read-only credential for ONE store. Send it as a Bearer header or as `?token=`. string **expires\_at** required 30 minutes from minting, in UTC. This is a fact about the credential, not a time at the store. string format: date-time **dashboard\_url** The embeddable dashboard for this store with the token already in it. OMITTED entirely when this deployment hosts no embedded dashboard. string #### Example generated ```json { "token": "example", "expires_at": "2026-04-15T12:00:00Z", "dashboard_url": "example" } ``` ### 401 `unauthorized`. A missing, malformed, unknown or revoked key; or an invalid, expired or wrong-store dashboard token. One answer for every case on purpose: the holder of a bad credential learns nothing from the difference. Media typeapplication/json object **error** required object **code** required The stable value to branch on. string Allowed values: unauthorized forbidden\_ip rate\_limited validation\_error location\_already\_exists location\_not\_found location\_terminated reservation\_not\_found conflict internal\_error **message** required A human sentence. Copy, not contract; it may be reworded. string **field** The request field at fault, dotted for a nested one (`plan.term_months`). string #### Example ```json { "error": { "code": "unauthorized" } } ``` ### 404 `location_not_found`. No store of this key carries that `partner_location_id`. Media typeapplication/json object **error** required object **code** required The stable value to branch on. string Allowed values: unauthorized forbidden\_ip rate\_limited validation\_error location\_already\_exists location\_not\_found location\_terminated reservation\_not\_found conflict internal\_error **message** required A human sentence. Copy, not contract; it may be reworded. string **field** The request field at fault, dotted for a nested one (`plan.term_months`). string #### Example ```json { "error": { "code": "unauthorized" } } ``` ### 409 `location_terminated`. No token is minted for a store with no contract. Media typeapplication/json object **error** required object **code** required The stable value to branch on. string Allowed values: unauthorized forbidden\_ip rate\_limited validation\_error location\_already\_exists location\_not\_found location\_terminated reservation\_not\_found conflict internal\_error **message** required A human sentence. Copy, not contract; it may be reworded. string **field** The request field at fault, dotted for a nested one (`plan.term_months`). string #### Example ```json { "error": { "code": "unauthorized" } } ``` ### 429 `rate_limited`. Over this key’s requests-per-minute ceiling. Media typeapplication/json object **error** required object **code** required The stable value to branch on. string Allowed values: unauthorized forbidden\_ip rate\_limited validation\_error location\_already\_exists location\_not\_found location\_terminated reservation\_not\_found conflict internal\_error **message** required A human sentence. Copy, not contract; it may be reworded. string **field** The request field at fault, dotted for a nested one (`plan.term_months`). string #### Example ```json { "error": { "code": "unauthorized" } } ``` ### 503 `internal_error`. The store token feature is not enabled on this deployment. A configuration state, not a fault: tell us and we will switch it on. Media typeapplication/json object **error** required object **code** required The stable value to branch on. string Allowed values: unauthorized forbidden\_ip rate\_limited validation\_error location\_already\_exists location\_not\_found location\_terminated reservation\_not\_found conflict internal\_error **message** required A human sentence. Copy, not contract; it may be reworded. string **field** The request field at fault, dotted for a nested one (`plan.term_months`). string #### Example ```json { "error": { "code": "unauthorized" } } ```