Authenticate with the Appstle Memberships API

Every Admin API request must include a valid API key in the request header. Keys are created and managed directly in your Appstle dashboard, scoped to a single Shopify store, and can be revoked individually without affecting your other integrations.

Creating an API key

Open API Key Management

Create a new key

Click Create New Key and give it a descriptive name that identifies the integration — for example, Klaviyo Integration, Mobile App, or Zapier Workflow.

Copy the key immediately

Your new key is displayed only once. Copy it now and store it in a secure location such as an environment variable or a secrets manager. You cannot retrieve the full key value again after leaving this screen.

Use the key in your requests

Pass the key in the X-API-Key header of every Admin API request.

Never expose your API key in client-side JavaScript, browser applications, or public source code repositories. API keys must only be used in server-side code.

Sending the API key

Include your key in the X-API-Key request header:

curl -X GET \
  "https://membership-admin.appstle.com/api/external/v2/membership-contracts?shop=your-store.myshopify.com&customerId=12345" \
  -H "X-API-Key: apst_your-api-key-here"

const response = await fetch(
  'https://membership-admin.appstle.com/api/external/v2/membership-contracts?shop=your-store.myshopify.com&customerId=12345',
  {
    headers: {
      'X-API-Key': process.env.APPSTLE_API_KEY,
    },
  }
);
const data = await response.json();

import requests
import os

response = requests.get(
    'https://membership-admin.appstle.com/api/external/v2/membership-contracts',
    params={'shop': 'your-store.myshopify.com', 'customerId': '12345'},
    headers={'X-API-Key': os.environ['APPSTLE_API_KEY']},
)
data = response.json()

You can also pass the key as a query parameter using ?api_key=apst_your-api-key-here, but the header approach is recommended for security.

Key format

All API keys use the apst_ prefix. Existing legacy keys created before this prefix was introduced continue to work without any migration required.

apst_AbCdEfGhIjKlMnOpQrStUvWxYz123456789012

Key management

You can create up to 10 active API keys per store. Managing keys from the dashboard gives you fine-grained control over which integrations can access your membership data.

Action	How
Create	Settings → API Key Management → Create New Key
Track	Each key displays its last-used timestamp so you can identify stale keys
Revoke	Click Revoke on any individual key — other keys are not affected
Rotate	Create a new key, update your integration, then revoke the old key

Create a separate API key for each integration. This way you can revoke access for a single integration without disrupting others — for example, if a third-party tool is compromised or decommissioned.

Storing keys securely

Store your API key as an environment variable and read it at runtime. Never hardcode it in your source files.

# .env — never commit this file
APPSTLE_API_KEY=apst_your-api-key-here

// Read from environment at runtime
const apiKey = process.env.APPSTLE_API_KEY;

Authentication errors

If your request is rejected due to authentication, you will receive a 401 Unauthorized response:

{
  "error": "Unauthorized",
  "message": "Invalid API key provided",
  "status": 401
}

Common causes:

The key was revoked from the dashboard
The key was copied with extra whitespace
The X-API-Key header is missing from the request
You are using a key that belongs to a different store

Partner integrations

If you are building a product that integrates with Appstle Memberships on behalf of multiple merchants (a CRM, helpdesk, email platform, or automation tool), use the Partner Integration Framework. Merchants connect your app with one click — no manual key exchange — and Appstle issues your app a scoped apst_... token for each approved store. Send the merchant’s scoped token as X-API-Key, exactly like a regular API key. Tokens are revoked automatically when a merchant disconnects or uninstalls Appstle. To get onboarded, email support@appstle.com with your company name, product description, base URL, and contact email.

Partner integrations bypass the paid API plan — merchants are never charged for your integration’s API usage. Direct API access (without a partner connection) requires an active API plan.

Get Started

Guides

Partner Integration

Webhooks

Admin API

Customer Portal API

Authenticate with the Appstle Memberships API

Creating an API key

Sending the API key

Key format

Key management

Storing keys securely

Authentication errors

Partner integrations

​Creating an API key

​Sending the API key

​Key format

​Key management

​Storing keys securely

​Authentication errors

​Partner integrations

Creating an API key

Sending the API key

Key format

Key management

Storing keys securely

Authentication errors

Partner integrations