Skip to main content
The Store API uses an API key. The Marketplace API needs nothing.

​
Getting a key

Growth → API in your shop dashboard.
You see the key once, when it’s created. Only a hash is stored, so there’s no way to retrieve it later. Lose it and you make a new one.
Keys look like ex_live_ followed by 64 hex characters.

​
Sending it

Either header works:
Server-side only. The Store API isn’t CORS-open, and a key shipped in browser JavaScript is a published key. If you need this data in a browser, proxy it through your own backend.

​
Scopes

A key carries an explicit list. A request without the right one gets a 403 naming what it needed.
Give a key the narrowest set that does its job. A read-only integration shouldn’t hold a :write scope — then a leaked key can’t change anything.

​
Per-key settings

Each key tracks when it was last used and how often, which is how you find out whether an old one is still in service before you delete it.

​
Errors

A 403

​
Rotating a key

1

Make the replacement

Same scopes.
2

Deploy it

Update your integration.
3

Check the old one has gone quiet

Its last-used time tells you.
4

Delete it

Or disable it first, if you want a step you can undo.