Getting Started

Authentication

Every request carries the store's API key as a Bearer token. A key opens one store only: its orders, products, leads and webhooks.

One key per store

The store owner generates the key in the dashboard, under API Key. A store has a single key; Regenerate gives it a new secret (the previous one stops working at once), Pause refuses every request until it is resumed. Keys start with rsk_.

Sending it

Authorization: Bearer rsk_A1b2C3d4…

The key belongs on your server. Never put it in a mobile app, in front-end JavaScript or in a repository: anyone holding it can read and change the store's orders.

When a key is refused

Status	Why
`401`	No `Authorization: Bearer rsk_…` header, an unknown or paused key, or an expired one.
`403`	The store, its owner or the key's creator is suspended.

{
    "error": "Unauthorized",
    "message": "Invalid API key."
}