Managing API keys from the dashboard
To connect an external application to your store, the first step is an API key. The dashboard screen gives you full control over each key: its name, stores, scopes and lifetime — and the secret is shown exactly once, at creation.
On this page
1.Where to find it
- Open the dashboard and go to "Settings".
- Choose "API Keys" — right next to "AI Tools (MCP)".
- You'll see your keys (if any) and the "New key" button up top.
2.Creating a new key
- Press "New key" and give it a clear name you'll recognize later (e.g. "Inventory sync").
- Pick the stores the key may operate on — choose several; selling or deactivating a store removes it from the key automatically.
- Pick scopes: read-only scopes for dashboards, write scopes if the app mutates data. Sensitive ones (inventory, orders, storefront design) are flagged "High risk" and need an extra confirmation.
- Optionally set an expiry date — the key deactivates itself afterwards.
- Press "Create key" — copy the secret immediately and store it somewhere safe.
3.Monitoring, rotating and revoking
The key list shows each key's name and prefix, its status (Active / Revoked / Expired), its stores and scopes, the created date, and when it was last used. "Last used" is how you spot dead keys worth revoking.
- Rotate: mints a fresh secret instantly and the old one dies that moment — ideal after a suspected leak; you can adjust scopes in the same step.
- Revoke: permanent — any app using the key loses access immediately.
- Expiry: a key past its date shows "Expired" and stops authenticating even if you never revoke it.
4.After you have the key
A key alone is not enough — your application needs to speak the API correctly: the base URL, the auth header, and the request/response shapes. All of it is documented in the full API guide, with copyable examples and the OpenAPI specification.
If what you want is AI tools (ChatGPT, Claude, …), that's the separate MCP screen next door: MCP for smart tools, API keys for your own applications and systems.