Create an API token

Watch the steps

1. 1Platform Setup
2. 2Integrations
3. 3Developer
4. 4API tokens
5. 5Create new API token
6. 6Name the token after the app that will use it
7. 7Tick only the permissions the app needs
8. 8Expiration
9. 9Create Token
10. 10View or copy the token from the list

Create an API token (0:33)

An API token lets your own website, app or AI agent work with your BCL account without your password. You create tokens in BCL and choose what each one can do. Only Admins can create them.

For the endpoints and request format, see the BCL API reference. To connect an AI assistant, see Connect Claude or ChatGPT to BCL or Set up other AI apps.

Where tokens live

API tokens are on the Integrations page:

1. In the sidebar, go to Platform Setup → Integrations.

   

2. Click Developer at the top right to show only the developer cards. On the API tokens card, click Manage. If you have no token yet, the button says Connect.

   

The API tokens panel opens on the right. It lists your tokens and shows how many tokens you have. The limit is 10. The AI agents card next to it lists the AI apps you signed in to with OAuth.

Create a token

Each Admin can have up to 10 tokens. To create one:

1. In the API tokens panel, click Create new API token.

   

2. The Create New API Token panel opens. In Token Name, type where you will use the token, such as “Kopi Kampung Website”. BCL suggests a name, which you can change.

3. Under Permissions, tick only what the app needs:

   Permission	Lets the token	Use it for
   API Read	Read forms, transactions, customers, coupons and other data through the API	Reports, dashboards, order sync to another system
   API Write	Create payment links and change data through the API	A website or app that creates payment links or updates forms
   MCP Read	Let an AI agent look up your data	Claude Code, Cursor, VS Code and other AI apps
   MCP Write	Let an AI agent create and change things	AI apps you trust to make changes

   

4. In Expiration, choose when the token expires: Never, 30 days, 90 days, 180 days or 365 days.

5. Click Create Token. BCL shows the message API token "<name>" has been created. and adds the token to the list.

API permissions and MCP permissions are separate. A token with only API Read and API Write does not work with an AI agent. An MCP-only token does not work with the API. API Write alone cannot read, so tick API Read too in most cases. You cannot change a token’s permissions later: create a new token instead.

When you have 10 tokens, the Create new API token button is hidden. Delete a token you no longer use first.

Use the token

A token starts with bcl_. Your system sends it in the Authorization header of every request:

Authorization: Bearer bcl_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
Accept: application/json

The API address is https://api.bcl.my/v1. Also send your own User-Agent, for example MyShop/1.0. BCL refuses requests from default script user agents such as plain curl or python-requests. Every endpoint is in the BCL API reference.

The token sees the same data as you. Tokens belong to the Admin who created them, and other Admins do not see them in their list.

View or copy a token again

BCL keeps your tokens, so you can see one again later. In the list in the API tokens panel:

• Click the View token icon (the eye) to show the token under its name. Click it again to hide it.
• Click the Copy token icon to copy it.

The list has these columns:

Column	What it shows
Name	The token name. An expired token shows Expired next to it, and you cannot view or copy it.
Abilities	The permissions: read and write for the API, mcp:read and mcp:write for AI agents
Expires	The date the token expires, or Never
Last Used	When an app last used the token, or Never
Actions	The View token, Copy token and Delete token icons

Delete a token

When you delete a token, each app that uses it loses access. To delete a token:

1. In the API tokens panel, click the Delete token icon (the bin) on the token’s row.

2. In Delete API Token, click Delete Token.

   

Each app that uses the token loses access at once. You cannot undo the deletion. If the app still needs access, create a new token and put it in the app.

AI agents

The AI agents card is next to API tokens. It lists the AI apps that you connected with OAuth, such as Claude, ChatGPT or Cursor. With OAuth, you sign in with your BCL account, and the app uses no token. Click Manage on the card. The panel shows each app, its permissions, the date you authorised it and the date of its last use. Until you connect an app, the button says Connect and the panel shows “No AI agents connected yet”.

To remove the access of an app, click the Revoke access icon on its row, then Revoke Access. See Disconnect an AI app.

Tips

A token gives access to your account. These habits keep your tokens safe:

• One token per app. Name it after the app and, for AI tools, the computer. If a token leaks, you delete only that token, and the other tokens continue to work.
• Remove access when staff leave. Tokens and connected AI agents belong to the Admin who made them. Other Admins cannot see them. Before an Admin leaves, ask them to delete their tokens. Replace each token that they had a copy of.
• Never paste a token in a public place. Keep it out of public code, screenshots and chat groups. If a token is exposed, delete it at once.
• Set an expiry. A token with Never works until someone deletes it. Check Last Used regularly, and delete the tokens that nobody uses.

Common issues

How do I get an API key to build my own integration?

Go to Platform Setup → Integrations, click Manage on the API tokens card and click Create new API token. Tick API Read, plus API Write if your system creates payment links or changes data.

See it in the steps

I lost my token. Do I have to create a new one?

No. Open the API tokens card on the Integrations page and click the View token or Copy token icon on the token's row. BCL keeps the token so you can see it again.

See it in the steps

Why do I get "Token does not have the 'api:write' ability"?

The token was created without API Write. Permissions cannot be changed later, so create a new token with API Write ticked and delete the old one.

See it in the steps

Related articles

• Connect Claude or ChatGPT to BCL
• Set up other AI apps (Cursor, Claude Code, VS Code and more)
• Payment form webhook payload
• Check what your AI agent did