The storefront key is public by design, which is why you can paste it into your store’s code. What protects it is its scope: one store, three permissions, 60 requests per minute and a revocation that takes effect instantly.

​
Where it comes from

You issue it from the admin: Settings → Keys for your storefront → Generate key. You can have several live keys and read any of them again, so losing one doesn’t force you to issue another. If you’re an agency, generate one key per client store: revoking one then doesn’t affect the others.
Every key in these docs is fake on purpose. A key that looks real ends up copied into a public repo.

​
What a key can do

Three things, nothing more: It can’t configure the store, turn on moments, read metrics or create connections: that stays in the admin. The quota is 60 requests per minute per key; whoever copies it gets that store’s quota, not the platform’s. The key identifies a single store, which is why the request doesn’t carry it: see what CrossUp decides.

​
Rotate without breaking

  1. Generate the new key in the admin.
  2. Deploy your store with the new one.
  3. Revoke the old one. The next request with it no longer gets in.

​
The key’s errors

An unexpected 404 with a valid key is almost always another store’s key, not a mistyped id. The shape of each error is in Errors.

Request recommendations

Each moment with its request and what comes back.

Quota and cache

How not to spend your quota on requests you’ve already made.