---
updatedAt: 2026-11-11T13:28:46.000Z
agentTools:
  projectIndex: https://developer.xentral.com/llms.txt
---

# Authentication

Authentication with the Xentral APIs is available through Personal Access Tokens (PATs).These allow you to securely communicate with Xentral APIs from an external application. For example, these applications can be small scripts that you developed or a customization built for you by a Xentral partner. With personal access tokens you can use the API with multiple applications at the same time.

Using the PATs, you can authenticate with all Xentral APIs (current Xentral API, REST API, Standard API). This way, you don't need to switch authentication methods when you want to use an older API. We still recommend you use the current Xentral API, because the older REST and Standard APIs can’t handle all endpoints when using personal access tokens. You can find a list of unavailable endpoints at the end of this article.

> 🚧 Coming with release 26.47 (early access from 17 November; all other customers with 26.49 from 8 December)
>
> New personal access tokens need an expiry date: the duration **Unlimited** is removed and the longest duration is 180 days. Tokens can no longer be locked. Existing tokens, including tokens without an expiry date, stay unchanged.

## Creating a Personal Access Token

> 📘 Prerequisite
>
> Make sure that you have admin rights before you try to create a personal access token.

Steps:

1. Click your user icon on the top right and then click **Account settings**.
2. Go to **Developer Settings** > **Personal Access Tokens**. You will see a list of your tokens.
3. Click **Create token** on the top right.
4. Enter a unique **Name** for your token. The name should not exceed 50 characters. You can add a **Description**.
5. Choose a **Duration**: 30, 60, 90 or 180 days, or **Unlimited**. The default is 180 days.
6. Under **Scopes**, choose the scopes the token may use: single scopes per area, **Admin read** (read-only access to any endpoint) or **Admin** (full administrative access to any endpoint).
7. Click **Create**. The new token will appear on screen.
8. Copy the token by clicking on the copy icon. After you close the window **you won't be able to see the token again. Make sure that you save the token in a secure place before you continue.**

   The name of the token will now appear in the list of Personal Access Tokens. You can paste the token into the application you want to give access to the Xentral API.

> 🚧 Be aware
>
> **Admin** and **Admin read** cover every endpoint, including endpoints added later, so choose single scopes where you can. A token expires at the end of its duration; a token with the duration **Unlimited** doesn't expire. A reminder email is sent 14 and 3 days before a token expires, and a token that hasn't been used for 180 days expires automatically.
>
> Don't share tokens publicly and don't hardcode them into external applications. Make sure you fully trust the external applications that you grant access to Xentral.
>
> You can disable an application's access to the Xentral API at any time by deleting the corresponding token.

## Editing and deleting personal access tokens

All your personal access tokens are listed under **Account settings** > **Developer Settings** > **Personal Access Tokens**. When you click **Edit**, you can:

* Change the name: enter the new **Name** and click **Update Token**.
* Change the duration: choose a new **Duration**: 60, 90 or 180 days, or **Unlimited**. The token then expires at the end of the new duration, counted from today. **No change** keeps the current expiry date.
* Delete the token: click **Delete token** to remove the application's access to the API. Deleting a token stops it from working immediately; the application you connected with this token will no longer work in the Xentral environment.

A locked token (**Lock / Unlock** in the token list) doesn't expire, not even when unused, and must be unlocked before it can be edited or deleted. Locking removes its expiry date.

## Unavailable endpoints in REST and Standard API

You can't access the following endpoints in the legacy APIs using personal access tokens. This list makes no claim to completeness.

```
/shopimport/auth
/shopimport/syncstorage/{articlenumber:.+}
/shopimport/articletoxentral/{articlenumber:.+}
/shopimport/articletoshop/{articlenumber:.+}
/shopimport/ordertoxentral/{ordernumber:.+}
/shopimport/articlesyncstate
/shopimport/statistics
/shopimport/modulelinks
/shopimport/disconnect
/shopimport/reconnect
/shopimport/status
/shopimport/refund
/v1/reports
```