Authentication
OpenStock Docs
How store API keys work, which permissions they carry and how to keep them safe.
All API requests authenticate with a store API key sent as a bearer token. A key belongs to exactly one store, so the API never needs a store ID in the URL.
Authorization: Bearer sk_your_secret_keyPermissions#
Each key carries a list of permissions. Grant only what an integration needs:
| Permission | Unlocks |
|---|---|
checkout_api | Checkout sessions |
withdrawal_api | Withdrawals |
customer_balance_api | Customer balance |
all | Every API |
Key lifecycle#
Keys can be disabled or given an expiry date from the dashboard. Requests with a disabled or expired key fail with 401 and the codes api_key_disabled or api_key_expired. Each successful request updates the key’s “last used” time so you can spot unused keys.
Keep secrets off the client
Never embed API keys in browser code or mobile apps. Call the API from your backend and expose only what your frontend needs.