Create an API token

Watch the steps

1. 1Platform Setup
2. 2Integrations
3. 3Developer
4. 4API tokens
5. 5Create new API token
6. 6Name the token after the app that will use it
7. 7Tick only the permissions the app needs
8. 8Expiration
9. 9Create Token
10. 10View or copy the token from the list

Create an API token (0:33)

An API token lets your own website, app or AI agent work with your BCL account without your password. You create tokens in BCL and choose what each one may do. Only Admins can create them.

For the endpoints and request format, see the BCL API reference. To connect an AI assistant, see Connect Claude or ChatGPT to BCL or Set up other AI apps.

Where tokens live

API tokens are on the Integrations page:

1. In the sidebar, go to Platform Setup → Integrations.

   

2. Click Developer at the top right to show only the developer cards. On the API tokens card, click Manage. If you have no token yet, the button says Connect.

   

The API tokens panel opens on the right. It lists your tokens and how many of the 10 you have used. The AI agents card next to it lists the AI apps you signed in to with OAuth.

Create a token

Each Admin can have up to 10 tokens. To create one:

1. In the API tokens panel, click Create new API token.

   

2. The Create New API Token panel opens. In Token Name, enter where the token will be used, such as “Kopi Kampung Website”. BCL suggests a name, which you can change.

3. Under Permissions, tick only what the app needs:

   Permission	Lets the token	Use it for
   API Read	Read forms, transactions, customers, coupons and other data through the API	Reports, dashboards, syncing orders to another system
   API Write	Create payment links and change data through the API	A website or app that creates payment links or updates forms
   MCP Read	Let an AI agent look up your data	Claude Code, Cursor, VS Code and other AI apps
   MCP Write	Let an AI agent create and change things	AI apps you trust to make changes

   

4. In Expiration, choose when the token stops working: Never, 30 days, 90 days, 180 days or 365 days.

5. Click Create Token. BCL shows the message API token "<name>" has been created. and adds the token to the list.

API permissions and MCP permissions are separate. A token with only API Read and API Write does not work with an AI agent, and an MCP-only token does not work with the API. API Write alone cannot read, so tick API Read too in most cases. You cannot change a token’s permissions later: create a new token instead.

When you have 10 tokens, the Create new API token button is hidden. Delete a token you no longer use first.

Use the token

A token starts with bcl_. Your system sends it in the Authorization header of every request:

Authorization: Bearer bcl_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
Accept: application/json

The API lives at https://api.bcl.my/v1. Also send your own User-Agent, for example MyShop/1.0: BCL refuses requests from default script user agents such as plain curl or python-requests. Every endpoint is in the BCL API reference.

The token sees the same data as you. Tokens belong to the Admin who created them, and other Admins do not see them in their list.

View or copy a token again

BCL keeps your tokens, so you can see one again later. In the list in the API tokens panel:

• Click the View token icon (the eye) to show the token under its name. Click it again to hide it.
• Click the Copy token icon to copy it.

The list has these columns:

Column	What it shows
Name	The token name. An expired token shows Expired next to it and can no longer be viewed or copied.
Abilities	The permissions: read and write for the API, mcp:read and mcp:write for AI agents
Expires	The date the token stops working, or Never
Last Used	When an app last used the token, or Never
Actions	The View token, Copy token and Delete token icons

Delete a token

Deleting a token cuts off every app that uses it. To delete one:

1. In the API tokens panel, click the Delete token icon (the bin) on the token’s row.

2. In Delete API Token, click Delete Token.

   

Any app using the token loses access at once. Deleting cannot be undone. If the app still needs access, create a new token and put it in the app.

AI agents

The AI agents card, next to API tokens, lists the AI apps, such as Claude, ChatGPT or Cursor, that you connected by signing in with your BCL account (OAuth). These use no token. Click Manage on the card to see each app, its permissions, when you authorised it and when it was last used. Until you connect an app, the button says Connect and the panel shows “No AI agents connected yet”.

To cut an app off, click the Revoke access icon on its row, then Revoke Access. See Disconnect an AI app.

Tips

Tokens are keys to your account. A few habits keep them safe:

• One token per app. Name it after the app and, for AI tools, the computer. If one leaks, you delete only that token and the rest keep working.
• Remove access when staff leave. Tokens and connected AI agents belong to the Admin who made them, and other Admins cannot see them. Ask a leaving Admin to delete theirs first, and replace any token they had a copy of.
• Never paste a token in a public place. Keep it out of website code that visitors can see, public Git repositories, screenshots and chat groups. If one is exposed, delete it straight away.
• Set an expiry. A token with Never works until someone deletes it. Check Last Used now and then and delete tokens nobody uses.

Common issues

How do I get an API key to build my own integration?

Go to Platform Setup → Integrations, click Manage on the API tokens card and click Create new API token. Tick API Read, plus API Write if your system creates payment links or changes data.

See it in the steps

I lost my token. Do I have to create a new one?

No. Open the API tokens card on the Integrations page and click the View token or Copy token icon on the token's row. BCL keeps the token so you can see it again.

See it in the steps

Why do I get "Token does not have the 'api:write' ability"?

The token was created without API Write. Permissions cannot be changed later, so create a new token with API Write ticked and delete the old one.

See it in the steps

Related articles

• Connect Claude or ChatGPT to BCL
• Set up other AI apps (Cursor, Claude Code, VS Code and more)
• Payment form webhook payload
• Check what your AI agent did