Skip to main content
API-key table with type, scope, and last use

API-key list in the shop dashboard

An API key is a secret for a program, not a person. You create it inside one shop and decide which resources it may access.

​
Two key types

Plugin

Reserved for the official real-time fulfillment protocol. The default and recommended scope is only orders:write.

Store (integration)

REST calls for one shop. Grant only the scope needed by the report, dashboard, or automation.
Account-wide keys are not offered. Account operations, shop creation, and owner-only actions require a dashboard session.

​
Create a key

1

Choose a preset

Minecraft plugin selects orders:write. Store integration proposes a read-only scope. Use Full access only for your own trusted system.
2

Set a name and type

Identify the service and environment, for example “Reports production”. Do not use a Plugin key as a general REST key.
3

Restrict permissions

Select the resource and action. write includes read; manage includes read, write, and delete.
4

Set an expiry

Pick a date for temporary integrations. Dates in the past are rejected.
5

Copy the secret

The full key is shown once. Store it in a secret manager, never in a repository or a file sent to users.

​
Permissions

The catalog covers Shop, Products, Servers, Orders, Payments, Payment methods, Discount codes, Vouchers, Statistics, API Keys, and Team. The dashboard reads the current list from GET /api/v2/api-keys/permissions.
A team member can create or expand a key only within their own scope. A shop key is also compared with {shopId} in the URL. Using it for another shop returns 403.

​
Use

Look for apiKeyAuth on an endpoint in the API reference. Not every Bearer endpoint accepts a key. A Plugin key connects over Socket.IO as described in the plugin guide; it does not use the retired REST polling flow.

​
Edit and revoke

The list shows the name, type, shortened preview, scope, creation, last use, expiry, and status. You can rename a key or reduce its scope. If the secret is lost, revoke the key and create another one; the full secret cannot be recovered. Revoke a key immediately when:
  • it appears in logs, chat, a support ticket, or a public repository;
  • the service is decommissioned;
  • you do not recognize its last use;
  • the integration or server changes hands.