Authentication

Every app in your workspace has its own API key. Find it in the console under your app’s row in Settings › Integrations › Shopify Partners (each tracked app lists its key).

Send it on every request:

X-Api-Key: <your app's API key>

Rules:

• The key identifies the app, so requests never need an app slug when the key is present.
• Keep it server-side only. Never ship it in frontend code, app bridge scripts, or mobile clients.
• One key per app: if you run multiple apps, each uses its own key and its data stays separated.
• A wrong or missing key returns 401 {"error": "invalid API key"}.

If a key leaks, rotate it from the console and update your backend’s environment variable.