API authentication

Real Business API key setup form, cropped before credential examples and existing-key metadata. Key name labels a credential; Create key would generate one. No key was created, recreated or revoked. The visible LIVE label is not Individual LIVE approval. Open full size.

Navigation: Settings → API Keys. API keys are store-scoped secrets. All active paid Business/Sole Trader plans (Basic, Professional and Enterprise) include API and SDK integration. Individual Creator (free), Pro and approved Scale configurations include API subject to their separate approval and environment controls. Preview does not automatically grant LIVE access.

1. Select the correct store and environment. ADMIN or higher permission is required to manage keys.
2. Create a key only when needed for the integration, and copy its full value into protected server configuration. Do not screenshot the key, its prefix or credential metadata.
3. Send either Authorization: Bearer <api-key> or x-api-key: <api-key> from your backend.
4. Use the key only for its store and environment. A request header/body claiming TEST cannot change a LIVE key’s identity.
5. If exposed, revoke the key and replace the server configuration. Never publish it in browser JavaScript, logs or a repository.

Base path: /public/catalog. Catalog routes include store products/product detail, categories, attributes and shipping methods. Individual model restrictions still apply; a shared route does not grant physical-shipping permission.

For authentication errors, check key revocation, store scope, permissions, plan and environment without logging the secret. No public merchant webhook-registration endpoint or public Checkout Link CRUD is established by this guide.

Related guides

Checkout and TEST restrictions · Integration overview