What it is
Tokens are created in Settings → MCP / API. The plaintext is shown once. Tokens are stored as hashes. Creating or revoking tokens requires the organisation owner and two-step verification.
Scopes include brand, content (campaigns, events, stories), embeds catalogue (external iframes only), media, main-website pages, and donation webhooks. WordPress plugin tokens are a fixed read-only set (brand:read, content:read, embeds:read) and must also send X-1NGO-Organization-Id.
Typical calls go to the Railway org-api origin shown on the tokens page, for example GET /org-api/v1/me with Authorization: Bearer 1ngo_…. Rate limit: 60 requests per minute per IP.
Update webhooks POST donation.received to your HTTPS URL with an HMAC signature. That is the programmatic alternative to WhatsApp live alerts.
What it is not
The API does not process card payments. Checkout stays on Paystack via 1 NGO public pages / embeds. Do not put secret tokens in public websites or in client-side JavaScript.