Getting access

How a merchant gets a console login, an API token, and which environment to point at.

Alyte is currently invite-onboarded: there is no self-serve signup yet. Here’s the path from zero to a working API token.

​

1 · Get a console login

Contact Alyte (your point of contact, or hello@alyte — whoever sent you here) with the email addresses of the people who need console access. You’ll receive a WorkOS invitation email; accepting it creates your login and attaches you to your organisation (your tenant — the isolation boundary all your data lives inside).

​

Roles

Two console roles, chosen on the invitation:

• owner — everything: shops, payment providers, catalog, team, and API keys of any scope.
• integrator — for a partner that runs your integration on your behalf: API keys (merchant:read, merchant:write, mandates:attest — never merchant:admin), the shop’s embed origins, and reads. It cannot create or delete shops, touch payment providers or the catalog, or invite anyone, and it can revoke only the keys it minted. Console → Team → role integrator.

​

2 · Know your environment

Environment	Base URL	What it’s for
Sandbox	https://app.alytegen.com (also https://alyte-sandbox-f365cfb3ma-ey.a.run.app)	Integration builds and tests. Stripe test keys, no real money. Self-serve API keys. Both hostnames serve the same deployment; signed agent requests must sign the hostname they call.
Production	(not yet public)	Live keys are gated: your tenant must be approved for go-live by Alyte before the console will mint one.

Use sandbox for integration testing. Pages explicitly marked planned or not enabled describe work that is not available there yet.

​

3 · Mint an API token

Console → API keys → mint with the scopes you need:

• merchant:read — catalog and payments reads
• merchant:write — catalog writes, webhooks, buyer-session minting, the shop’s public settings (embed origins, discovery, image)
• merchant:admin — creating or deleting shops and linking a payment provider (the money path). The console’s full preset mints read + write + admin; read + write is right for a partner that runs your catalog, webhooks and buyer sessions but should not touch your shops or PSP
• mandates:attest — the separate attest verified customers only choice, shown only when Alyte has enabled contracted attestation for your organization

See Console and API keys for scope selection, attested-session minting and what happens when enablement is removed.

The token is shown once. It’s a server-to-server secret: env var or secret manager, never a browser, never a repo.

Lifecycle: API tokens are long-lived machine credentials (one-year outer bound; the mint response’s expiresAt says exactly when). The working control is revocation: deleting a key in the console kills its tokens immediately — a server-side check on every request, not token expiry. Rotate by minting a new key, deploying it, then revoking the old one.

​

4 · Connect your PSP

Console → your shop → Connect a PSP: paste your Stripe secret key and publishable key — copy both from the same API-keys page of the same Stripe account (a mismatched pair is the most common integration failure; the card-capture window won’t load). The secret is vaulted immediately — Alyte stores only an opaque reference.

From here, the Quickstart takes over.