Users can create API tokens from Security. Authenticated requests use Bearer tokens against the /api/v1 endpoints for plans, orders, invoices, and tickets. Admins can create webhook endpoints to receive events such as invoice.paid, order.created, order.manual_review, order.provisioning_started, and upgrade.completed.