Updated 2026-06-01
API keys
Create, rotate, and manage publishable and secret shop API keys.
Shop API keys are generated when you create a shop. You can rotate them anytime — old keys stop working immediately.
Where to find them
Settings → API & Webhook. The publishable key is always visible. The secret key is only revealed once at creation or rotation.
Rotating keys
Key rotation (admin)
POST
/shop/api/rotate-publishable-keyRotate the shop's publishable client key.
SessionPOST
/shop/api/rotate-secret-keyRotate the shop's secret server key (revealed once).
SessionRotation is immediate
Rotating a key invalidates the old one instantly. Update any integrations using the old key before or immediately after rotating to avoid downtime.
Personal API keys
Separately, each user has a personal API key (sp_live_...) for account-level access. Only one active personal key is allowed at a time — creating a new one deactivates the old.
Personal API key endpoints
GET
/apiKeys/Get the user's active personal API key.
SessionPOST
/apiKeys/Create a new key (deactivates existing).
SessionPOST
/apiKeys/:id/rotateRotate an existing key's value.
SessionDELETE
/apiKeys/:idDelete a key.
Session