/api/v1/storefront directly with anonymous published reads, cart capabilities, and customer JWTs.
Generate an API key only for a private admin, partner, or CLI integration that runs in a trusted server environment.
Create the key
- Open the Dashboard Developers page.
- Sign in as an organization admin for the merchant account.
- Create a key with a clear environment and service name.
- Select only the permissions the server integration needs. Read and write permissions are independent; selecting write does not grant read.
- Copy the token when it is shown, verify the displayed granted permissions, and put the token in the server platform’s secret manager.
X-API-Key request header from your trusted server process.
Use separate credentials for development, staging, and production. Test deployments accept only
crv_test_ keys and production accepts only crv_live_ keys. A wrong-tier, expired, revoked, or
under-scoped key fails closed.
Keys created before explicit permissions were introduced may show no scopes and can no longer call
private scoped routes. Create a least-privilege replacement, update the consumer through its secret
manager, verify the replacement, and then revoke the old key. Rotate or revoke any key that is
exposed or no longer used. Expired and revoked keys do not count toward the active-key limit. If
three active keys already exist, use the fourth slot only for replacement overlap and return to no
more than three after cutover.
For storefront implementation, continue with the Storefront SDK guide or REST API essentials.