API & webhook settings

Every shop has a publishable key (read) and a secret key (write) for the Store API, plus event-scoped webhooks with delivery logs.

Shop API keys

Your publishable key is safe for client-side use (read-only). Your secret key authorizes write operations and is revealed once at creation or rotation. Rotate either key anytime — old keys stop working immediately.

Webhooks

Create multiple webhooks per shop, each scoped to specific events. Every webhook gets an auto-generated signing secret (HMAC). Saleporia signs each delivery with X-StoreSuite-Signature and includes the event name in X-StoreSuite-Event headers.

Available events

• order.created — a new order is placed
• order.updated — an order's status or details change
• order.cancelled — an order is cancelled
• order.fulfilled — an order is marked fulfilled
• customer.created — a new customer signs up
• product.updated — a product's details change
• inventory.low — a product drops below its stock threshold

Delivery logs

Every webhook delivery is logged with the response status and latency. View logs per webhook, clear them, or send a signed test event (webhook.test) to verify your endpoint.