Skip to main content
Every endpoint requires an API key, sent as a bearer token.

​
Creating a key

  1. Open Account Settings → API Keys in the dashboard
  2. Click Create New API Key and name it after the integration that will use it
  3. Select its scopes
  4. Copy the key
The key is shown once and can’t be retrieved later. Keep it in an environment variable or a secrets manager, never in source control.

​
Required headers

​
Scopes

Each key carries a fixed set of scopes, chosen when you create it. They decide which endpoints it can reach: stores.orders.view to read orders, stores.orders.refund to refund them, and so on. Scopes can’t be edited afterwards. To change what a key can do, create a new one and retire the old. Two habits worth adopting from the start:
  • One key per integration. You can then revoke a single integration without breaking everything else.
  • Only the scopes it needs. A reporting script has no business holding stores.orders.refund.

All scopes

Every permission a key can carry, and what each one unlocks.

​
When authentication fails

Both return the standard error envelope, with code set to AccessDenied. See Responses & Errors.
Last modified on August 2, 2026