Skip to main content
API keys let an outside system, such as a logistics partner or a developer working for you, read data from your shop through the Partner API. Each key belongs to your shop, carries only the permissions you choose, and can be revoked at any time.
This page covers features gated by Admin-tier permissions — typically Settings access. Admins have these by default; your administrator can adjust who has them in Settings > Team.

​
Before you start

API keys are part of the API Access add-on, available on Enterprise plans and to select partners and integrators. If it isn’t on your plan, the API Keys screen still lists any existing keys but you can’t create, rotate, or revoke them. Contact us to discuss adding API access to your plan.

​
Creating a key

Go to Settings > API Keys and click Create API key.
1

Name the key

Give the key a recognisable name, such as “Acme Logistics integration”, so you always know which system it belongs to. Use one key per integration.
2

Choose scopes

Scopes control what the key can do: read orders, read customers, include personal contact details, create customers, read products, or manage webhook subscriptions. Grant only what the integration actually needs. See Authentication for what each scope covers.
3

Set an expiry

Every key must expire. The expiry is set to 90 days ahead by default, and you can choose any date up to 365 days from today.
4

Copy the token

When you click Create API key, the new token appears once at the top of the API Keys screen. Copy it straight away and pass it to your integration partner through a secure channel.
The token is shown only once, immediately after the key is created. If you leave the screen without copying it, it cannot be recovered. Rotate the key to get a new token instead.

​
Managing your keys

The API Keys screen lists every key with its scopes, when it was last used, when it expires, and its status: Active, Expired, or Revoked.
  • Rotate issues a new token for the key and shows it once, just like creating a key. The old token stops working immediately, so coordinate with your integration partner before rotating. Rotation also resets the expiry to 90 days from today.
  • Revoke cuts the key’s access immediately and cannot be undone. Use it when an integration ends or you suspect a token has leaked. Create a new key if you need access again later.
Every key created, rotated, or revoked is recorded in your Audit Logs.

​
Webhooks are managed by your partner

Webhook subscriptions are not set up on this screen. Your integration partner creates and manages them through the API itself, using a key that carries the webhook scope. If a partner asks for webhooks, all you need to do is include that scope when you create their key. See Webhooks for what your partner will set up.
Last modified on July 2, 2026