API Keys

API keys allow external applications and services to access your store's data without user authentication. Stores can have multiple API keys — use a different key for each integration.

---

Managing API Keys

1. Go to Admin → Settings → API Keys
2. Click Create Key to generate a new key
3. Copy and save it immediately — it's shown only once

To remove access for an integration, delete the key from the same page. There's no "regenerate" — create a new key and delete the old one.

---

API Key Format

Keys follow the format:

sk_live_xxxxxxxxxxxx

• sk_live_ — Standard prefix for live secret keys
• xxxxxxxxxxxx — 12 random alphanumeric characters

Keys are stored as SHA-256 hashes in the database. The plaintext key is never stored and cannot be recovered. If you lose a key, delete it and create a new one.

---

Using the API Key

Send the key in the X-Store-API-Key header to the GraphQL endpoint. The backend resolves your store automatically from the key — you don't need the public ID in the URL:

# Set your API key as an environment variable:
# export STORE_API_KEY="sk_live_..."

curl -X POST https://entaprenua.com/api/v1/graphql \
  -H "Content-Type: application/json" \
  -H "X-Store-API-Key: $STORE_API_KEY" \
  -d '{"query": "{ products { id name price } }"}'

Or in JavaScript:

const API_KEY = process.env.STORE_API_KEY

const response = await fetch('https://entaprenua.com/api/v1/graphql', {
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',
    'X-Store-API-Key': API_KEY,
  },
  body: JSON.stringify({
    query: '{ products { id name price } }',
  }),
})
const { data } = await response.json()

---

Visibility Filtering

API keys provide public visibility access only. When accessing endpoints with an API key:

• Products with visibility: public — returned
• Products with visibility: private or draft — hidden

This means:

• Storefront integrations can safely use API keys to display products
• Sensitive/draft content is never leaked via API key access
• For full access (all visibility levels), use JWT authentication from the dashboard

---

Example: Building a Storefront Integration

const API_KEY = process.env.STORE_API_KEY
const GRAPHQL_URL = process.env.GRAPHQL_URL || 'https://entaprenua.com/api/v1/graphql'

async function graphql(query: string) {
  const response = await fetch(GRAPHQL_URL, {
    method: 'POST',
    headers: {
      'Content-Type': 'application/json',
      'X-Store-API-Key': API_KEY,
    },
    body: JSON.stringify({ query }),
  })
  return response.json()
}

// Fetch public products
const { data: { products } } = await graphql('{ products { id name price } }')

// Fetch a category with its subcategories
const { data: { category } } = await graphql(`
  query($id: ID!) {
    category(id: $id) {
      name
      children { id name }
    }
  }
`)

---

Security Best Practices

1. Never expose API keys in client-side code — use server-side API calls or environment variables
2. Rotate keys regularly — delete old keys and create new ones every 90 days
3. Use separate keys per integration — a different key for each service (mobile app, zapier, etc.)
4. Store keys in environment variables — never commit keys to version control
5. API keys are for public data only — use JWT for administrative operations

---

Endpoints Available via API Key

The recommended approach is to use the GraphQL endpoint at POST /api/v1/graphql. When you include the X-Store-API-Key header, the backend resolves your store automatically — no public ID in the URL needed.

The REST API also works with the API key header and similarly auto-resolves the store from the key. The public ID in the URL (/api/v1/{publicId}/...) is only required for JWT-authenticated dashboard sessions, where the store must be explicitly identified.

Data accessible via API key includes:

• Products, categories, orders, heroes, coupons
• Store settings (schema-driven — GET is public)
• Media library
• Cart operations (session-based)