This article explains how Organization Admins can create and manage API Tokens in GrowFlow Retail. Use an API token to give your own developers, a contracted developer, or an internal tool secure access to your organization's data through the GrowFlow Retail GraphQL API, without waiting on GrowFlow Support to issue credentials.
Please Note: API Tokens are for access you set up yourself. If you are connecting a third-party partner (such as a menu, marketing, or compliance provider), follow that partner's setup article instead. Those partners use credentials issued by GrowFlow.
Who can manage API tokens
Only users with the Organization Admin permission can see the API Tokens page. Store-level Admins do not have access. If you don't see the page, ask an Organization Admin in your company.
Create an API token
1. Click on Organization Settings (the globe icon in the left-side navigation).
2. Select API Tokens, found below General and Subscription.
3. Click the green plus + button in the top-right corner of the page.
4. The Add New API Token window opens. Fill in the following:
Name: who or what will use the token, for example Warehouse sync or BI dashboard. You can use up to 80 characters.
Expires: choose Never, 30 days, 90 days, 180 days, or 1 year. An expired token stops working right away. You can extend or remove the expiration later.
Store Access: check the stores this token can access. The store you are currently logged in to is selected by default. Select All includes every store. You must choose at least one store.
Scopes: choose what the token is allowed to do. Scopes are grouped into Read and Create. Check a group heading to select the whole group, or use Select all and Select none. You must choose at least one scope.
Tip: Grant only the stores and scopes the integration needs. For example, a reporting tool that only reads sales data might need just Orders, Order items, and Transactions.
5. Click Save & Close. A window opens showing your new token and a sample request.
6. Click Copy and store the token somewhere secure, such as a password manager, then click Done.
IMPORTANT: This is the only time the full token is shown. GrowFlow cannot show it to you again. If you lose it, revoke the token and create a new one. Treat the token like a password: anyone who has it can access the data it allows.
What each scope allows
Scope | Allows the token to |
Brands | Read brands |
Customers | Read customers and loyalty balances |
Discounts | Read discounts |
Menus | Read a published menu by its menu key |
Order items | Read order items |
Orders | Read orders |
Packages & inventory | Read packages and inventory records |
Product categories | Read product categories |
Products | Read products |
Stores | Read stores |
Test results | Read lab test results for packages |
Transactions | Read payment transactions |
Transfers | Read transfers |
Create customers | Create customers and adjust loyalty points |
Create preorders | Create preorders and read their status |
Create transfers | Create incoming transfers |
How Store Access works
Orders, order items, transactions, packages, inventory, and transfers only include the stores selected on the token.
Stores only returns the stores selected on the token.
Products, product categories, brands, discounts, and customers are shared across your organization, so the token can read all of them.
Menus are read by menu key. A token can read any published menu in your organization if it has the menu key.
Create transfers only works for stores selected on the token.
Using your token
Give the token to your developer. They send it with each request to your organization's GraphQL API as a bearer token:
Authorization: Bearer gfr_your_token_here
Each organization has its own API address, which is shown in the sample request when you create a token and in the API Developer Guide.
API Developer Guide
Click API Developer Guide at the top of the API Tokens page for technical details your developer will need:
Quick start: your API address, how to send the token, and a sample request
Try it: paste a token and run test queries right from the browser. Load schema lists every operation the token can use.
Explore the schema: recommended tools for browsing everything the API offers
Scopes reference, Store access and data rules, Rate limits and pagination, and Token lifecycle
Click Print / Save as PDF to save the guide and share it with your developer.
Limits
Rate limit: 120 requests per minute per token. If a request goes over the limit, it is rejected with a message to wait and try again.
Page size: each request returns up to 100 records. Larger result sets are split into pages.
Edit, disable, or revoke a token
The API Tokens list shows each token's name, the first few characters of the token (so you can tell them apart), its scopes, stores, status, expiration, and when it was last used and created.
Edit: click Edit on the token to change the name, expiration, stores, or scopes. Changes take effect within 30 seconds.
Disable: while editing, turn off the Active toggle. The token stops working within 30 seconds and stays off until you turn it back on.
Revoke: click Revoke on the token and confirm. Revoking is permanent. Anything using the token stops working within 30 seconds.
Replacing a token: create the new token, update your integration to use it, then revoke the old one. Both tokens work in the meantime, so there is no downtime.
When a developer's work with you ends, revoke their token to remove their access.
Activity Log
Click the Activity Log button (the pulse icon next to the green plus + button) to see who created, edited, or revoked each token and what changed. The token itself is never shown in the log.
Troubleshooting
Message | What to do |
API tokens are not available | You need the Organization Admin permission, or the feature is not yet enabled for your organization. Contact GrowFlow Support. |
Invalid or revoked API token | The token was mistyped, revoked, disabled, or has expired. Check its status on the API Tokens page, or create a new one. |
Insufficient Permissions for Requested Query or Mutation | The token doesn't have the scope for that request. Edit the token and add the scope. |
This API token does not have access to the requested store | The request tried to create a transfer for a store that isn't on the token. Edit the token's Store Access. |
Fewer records than expected | The token only returns data for its selected stores. Check the token's Store Access. |
Rate limit exceeded | The token went over 120 requests per minute. Wait a moment and try again. |
Still need help? Reach out to GrowFlow Support through the chat in the bottom-right corner.