Skip to content
CreatoRainCreatoRain API

Mint a 30 minute read-only token for one store

POST
/locations/{partner_location_id}/dashboard-token
curl --request POST \
  --url https://data.creatorain.com/partner/v1/locations/store_123/dashboard-token \
  --header 'Authorization: Bearer <token>'

Issues a credential whose entire authority is ONE store, for 30 minutes, read only. This is what makes the embedded merchant dashboard possible: the merchant’s browser holds this token and never your master key.

Mint one when you render the embed. It cannot be refreshed and it cannot mint another one: this route requires the PARTNER KEY, so a leaked merchant URL expires rather than renewing.

The token is accepted by the three GET /locations/{partner_location_id}... routes and nowhere else, as Authorization: Bearer <token> or ?token=<token>.

dashboard_url is omitted when this deployment hosts no embedded dashboard.

Authorizations

Section titled “Authorizations”

Parameters

Section titled “Parameters”

Path Parameters

Section titled “Path Parameters”
partner_location_id
required
string
<= 200 characters

YOUR id for the store, as you sent it to POST /locations.

Example 

store_123

Responses

Section titled “Responses”

200

Section titled “200”

A fresh token.

Media typeapplication/json
object
token
required

A read-only credential for ONE store. Send it as a Bearer header or as ?token=.

string
expires_at
required

30 minutes from minting, in UTC. This is a fact about the credential, not a time at the store.

string format: date-time
dashboard_url

The embeddable dashboard for this store with the token already in it. OMITTED entirely when this deployment hosts no embedded dashboard.

string

Example generated

{
  "token": "example",
  "expires_at": "2026-04-15T12:00:00Z",
  "dashboard_url": "example"
}

401

Section titled “401”

unauthorized. A missing, malformed, unknown or revoked key; or an invalid, expired or wrong-store dashboard token. One answer for every case on purpose: the holder of a bad credential learns nothing from the difference.

Media typeapplication/json
object
error
required
object
code
required

The stable value to branch on.

string
Allowed values: unauthorized forbidden_ip rate_limited validation_error location_already_exists location_not_found location_terminated reservation_not_found conflict internal_error
message
required

A human sentence. Copy, not contract; it may be reworded.

string
field

The request field at fault, dotted for a nested one (plan.term_months).

string

Example 

{
  "error": {
    "code": "unauthorized"
  }
}

404

Section titled “404”

location_not_found. No store of this key carries that partner_location_id.

Media typeapplication/json
object
error
required
object
code
required

The stable value to branch on.

string
Allowed values: unauthorized forbidden_ip rate_limited validation_error location_already_exists location_not_found location_terminated reservation_not_found conflict internal_error
message
required

A human sentence. Copy, not contract; it may be reworded.

string
field

The request field at fault, dotted for a nested one (plan.term_months).

string

Example 

{
  "error": {
    "code": "unauthorized"
  }
}

409

Section titled “409”

location_terminated. No token is minted for a store with no contract.

Media typeapplication/json
object
error
required
object
code
required

The stable value to branch on.

string
Allowed values: unauthorized forbidden_ip rate_limited validation_error location_already_exists location_not_found location_terminated reservation_not_found conflict internal_error
message
required

A human sentence. Copy, not contract; it may be reworded.

string
field

The request field at fault, dotted for a nested one (plan.term_months).

string

Example 

{
  "error": {
    "code": "unauthorized"
  }
}

429

Section titled “429”

rate_limited. Over this key’s requests-per-minute ceiling.

Media typeapplication/json
object
error
required
object
code
required

The stable value to branch on.

string
Allowed values: unauthorized forbidden_ip rate_limited validation_error location_already_exists location_not_found location_terminated reservation_not_found conflict internal_error
message
required

A human sentence. Copy, not contract; it may be reworded.

string
field

The request field at fault, dotted for a nested one (plan.term_months).

string

Example 

{
  "error": {
    "code": "unauthorized"
  }
}

503

Section titled “503”

internal_error. The store token feature is not enabled on this deployment. A configuration state, not a fault: tell us and we will switch it on.

Media typeapplication/json
object
error
required
object
code
required

The stable value to branch on.

string
Allowed values: unauthorized forbidden_ip rate_limited validation_error location_already_exists location_not_found location_terminated reservation_not_found conflict internal_error
message
required

A human sentence. Copy, not contract; it may be reworded.

string
field

The request field at fault, dotted for a nested one (plan.term_months).

string

Example 

{
  "error": {
    "code": "unauthorized"
  }
}