Skip to main content

Developers: System API Key

Audience: Developer (platform/backend)

What It Is​

The System API key is the platform-level server key for trusted backend integrations.

  • key type: client
  • prefixes: eshopos_test_ck_..., eshopos_live_ck_...

This key is separate from secret/publishable credentials.

Use It For​

  • server-to-server jobs
  • ERP/WMS/BI sync workers
  • high-trust backend automations

Do Not Use It In​

  • browser JavaScript
  • mobile bundles
  • any client-side app

Management Endpoints​

  • GET /api/v1/merchant/api-keys
  • POST /api/v1/merchant/api-keys
  • POST /api/v1/merchant/api-keys/{keyID}/rotate
  • POST /api/v1/merchant/api-keys/{keyID}/revoke

Create Example​

BASE_URL="http://localhost:8080"

curl -sS -X POST "$BASE_URL/api/v1/merchant/api-keys" \
  -H "Authorization: Bearer $DASHBOARD_BEARER_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "Primary System Key",
    "key_type": "client",
    "mode": "live",
    "scopes": ["public:*"]
  }'

The full api_key is returned once (one_time: true). Store it in a secret manager.