Storefront keys

Keys for the Storefront API, for a headless storefront your system sets up: publishable keys for browsers on the shop's own sites, secret keys for servers.

Reach them through admin.keys. Reading needs the keys:read scope, creating and revoking keys:write. Admin keys can't be made here. Use the keys with the Storefront client.

List keys

admin.keys.list(query?: ListQuery): Promise<CursorPage<ApiKey>>

One page of the shop's active Storefront keys. A key issued to an app sees only the keys that app made. Read the next page with meta.nextCursor as cursor. Scope: keys:read.

Parameters

Query fields

Returns

A CursorPage<ApiKey>:

Errors

Example

const { data } = await admin.keys.list({ limit: 50 });

for (const key of data) {
    console.log(key.name, key.type);
}

Iterate over every key

admin.keys.all(query?: ListQuery): AsyncGenerator<ApiKey, void, undefined>

Every key matching the query, one at a time, fetching the next page as you read. It takes the same query as list, without cursor. Scope: keys:read.

Returns

An async generator of ApiKey, each:

Example

for await (const key of admin.keys.all()) {
    await erp.saveKey(key.id, key.name, key.lastUsedAt);
}

Create a key

admin.keys.create(input: ApiKeyInput, options?: RequestOptions): Promise<CreatedApiKey>

A publishable key (its allowed sites required, sign-in return addresses optional) or a secret key. The full value is in value, returned only now for a secret key. A key an app makes has the app's name appended; its publishable key may list only the origin of the shop's own site address, and its return addresses must be on that origin, under the site's path (422 site_origin_required). Scope: keys:write.

Parameters

Request fields

Returns

A CreatedApiKey: the key in data, and its full value in value.

Errors

Example

const { data: key, value } = await admin.keys.create({
    name: 'Next.js storefront',
    type: 'publishable',
    allowedOrigins: ['https://www.example.com'],
    redirectUris: ['https://www.example.com/account/callback'],
});

Revoke a key

admin.keys.revoke(id: number): Promise<void>

The key stops at once, and shoppers signed in through its client are signed out. Scope: keys:write.

Parameters

Returns

Nothing.

Errors