Platform
API Client Management
The API Clients section lets you create and manage the OAuth2 credentials that your POS systems and integrations use to access the Puntjes API.
API clients list
Navigate to API Clients in the sidebar. The page shows:
- Client count vs. limit: how many clients you've created relative to your plan's maximum
- Table: all clients with their label, client ID, default branch, status (Active/Revoked), and creation date
If you've reached your client limit, the create button is disabled with a warning message.
Creating a client
Click Create and enter a label for the new client (e.g., "Main POS Terminal", "Online Store").
After creation, the client secret is displayed once in a dialog. Copy it immediately using the copy button. The secret cannot be retrieved again after closing the dialog.
Save the secret immediately
The client secret is only shown once at creation time. If you lose it, you'll need to regenerate it, which invalidates the previous secret.
Client actions
Set the default branch
Pick a branch in the Default branch column. A transaction that arrives on this client with no branch in its payload is then recorded at that branch instead of staying unassigned. A payload that names a branch itself always wins.
Choose No default branch to undo this. Transactions already recorded keep the branch they were filed under.
A closed branch does not fall back
Deactivate a branch a client still defaults to and transactions sent without a branch are refused with BRANCH_INACTIVE (422), rather than filed as unassigned. Point the client at another branch first.
Reveal secret
Click the eye icon to reveal an existing client's secret. This requires password confirmation. The secret is shown in a modal with a copy button.
Regenerate secret
If a secret is compromised or lost, click Regenerate to create a new one. This requires password confirmation. The old secret is immediately invalidated. Any integrations using it will stop working until updated with the new secret.
Revoke client
Click Revoke and confirm to permanently disable a client. Revoked clients cannot authenticate and their tokens are invalidated. This action cannot be undone.
Best practices
- One client per integration: create separate clients for each POS terminal or service for better auditability and easier revocation
- Label clearly: use descriptive labels so you can identify which system each client belongs to
- Rotate secrets periodically: regenerate them on a fixed schedule
- Revoke immediately: if a client is compromised or a terminal is decommissioned, revoke the client right away
See Authentication for how to use client credentials to obtain API access tokens.