This page explains how to authenticate requests to the Storefront API.
Bearer token
The Storefront API uses API keys passed as a bearer token in the Authorization header:
Authorization: Bearer YOUR_API_KEY
Each key belongs to exactly one organization; that organization is the tenant
for every request, derived solely from the key. Only storefront keys
(store_sk or store_pk) are recognized here — an admin key is not accepted
and fails authentication as if it were invalid.
If the header is missing, malformed, or the key is not a valid storefront key, the API returns:
- Status:
401 Unauthorized - Body:
{ "error": "Invalid or missing API key", "details": {} }Security recommendations
- Treat secret keys as secrets: never embed a
store_skkey in public client-side JavaScript. - Use a publishable key (
store_pk) for browser-facing integrations, or proxy from your backend. - Browsers may call the API directly:
/store/v0answers CORS preflight requests from any origin. The Admin API does not. - Rotate keys if you suspect exposure.
- Use HTTPS exclusively.
