Authentication

Use a store-scoped API key from a trusted server.

Create keys in the Custom Products app admin under API Access. The only available scope is production_files:read. The key is store-scoped: the store is taken from the credential, so API requests do not accept a store ID.

http

Authorization: Bearer cpk_live_YOUR_KEY

Key lifecycle#

The full secret is returned only when the key is created.
A key may have an optional future expiry date.
Revocation stops new requests immediately.
When the app is uninstalled from the store, its keys are revoked.
For rotation, create and verify the replacement key before revoking the old one.