Getting access

Alyte is currently invite-onboarded: there is no self-serve signup yet. Here’s the path from zero to a working API token.

​

1 · Get a console login

Contact Alyte (your point of contact, or hello@alyte — whoever sent you here) with the email addresses of the people who need console access. You’ll receive a WorkOS invitation email; accepting it creates your login and attaches you to your organisation (your tenant — the isolation boundary all your data lives inside).

​

2 · Know your environment

Everything in these docs works against sandbox. The API surface is identical.

​

3 · Mint an API token

Console → API keys → mint with the scopes you need:

• merchant:read — catalog and payments reads
• merchant:write — catalog writes, PSP links, buyer-session minting

The token is shown once. It’s a server-to-server secret: env var or secret manager, never a browser, never a repo. Lifecycle: API tokens are long-lived machine credentials (one-year outer bound; the mint response’s expiresAt says exactly when). The working control is revocation: deleting a key in the console kills its tokens immediately — a server-side check on every request, not token expiry. Rotate by minting a new key, deploying it, then revoking the old one.

​

4 · Connect your PSP

Console → your shop → Connect a PSP: paste your Stripe secret key and publishable key — copy both from the same API-keys page of the same Stripe account (a mismatched pair is the most common integration failure; the card-capture window won’t load). The secret is vaulted immediately — Alyte stores only an opaque reference. From here, the Quickstart takes over.