Authentication

API keys

API keys authenticate your server-to-server requests. You create and revoke them on your store's Developers tab.

Creating a key

Create and revoke keys in the dashboard: open your store, go to its Developers tab, then API keys. There is no API to mint keys. A key is a bearer token; the secret is shown only once at creation, and a non-secret prefix identifies it afterward.

bash

Authorization: Bearer <id>|<secret>

The secret is shown once. Store it securely. If lost, revoke the key and create a new one.

Scopes

Each key carries abilities. Grant least privilege: a read-only integration needs only invoices:read; creating invoices needs invoices:write.

Restrictions

Keys can be given an IP allowlist and are rate limited. See IP allowlisting and Rate limits for details.