Authenticate with the Appstle Memberships API

Every Admin API request must include a valid API key in the request header. Keys are created and managed directly in your Appstle dashboard, scoped to a single Shopify store, and can be revoked individually without affecting your other integrations.

Creating an API key

Open API Key Management

Create a new key

Click Create New Key and give it a descriptive name that identifies the integration — for example, Klaviyo Integration, Mobile App, or Zapier Workflow.

Copy the key immediately

Your new key is displayed only once. Copy it now and store it in a secure location such as an environment variable or a secrets manager. You cannot retrieve the full key value again after leaving this screen.

Use the key in your requests

Pass the key in the X-API-Key header of every Admin API request.

Never expose your API key in client-side JavaScript, browser applications, or public source code repositories. API keys must only be used in server-side code.

Sending the API key

Include your key in the X-API-Key request header:

curl -X GET \
  "https://membership-admin.appstle.com/api/external/v2/membership-contracts?shop=your-store.myshopify.com&customerId=12345" \
  -H "X-API-Key: apst_your-api-key-here"

const response = await fetch(
  'https://membership-admin.appstle.com/api/external/v2/membership-contracts?shop=your-store.myshopify.com&customerId=12345',
  {
    headers: {
      'X-API-Key': process.env.APPSTLE_API_KEY,
    },
  }
);
const data = await response.json();

import requests
import os

response = requests.get(
    'https://membership-admin.appstle.com/api/external/v2/membership-contracts',
    params={'shop': 'your-store.myshopify.com', 'customerId': '12345'},
    headers={'X-API-Key': os.environ['APPSTLE_API_KEY']},
)
data = response.json()

You can also pass the key as a query parameter using ?api_key=apst_your-api-key-here, but the header approach is recommended for security.

Key format

All API keys use the apst_ prefix. Existing legacy keys created before this prefix was introduced continue to work without any migration required.

apst_AbCdEfGhIjKlMnOpQrStUvWxYz123456789012

Key management

You can create up to 10 active API keys per store. Managing keys from the dashboard gives you fine-grained control over which integrations can access your membership data.

Action	How
Create	Settings → API Key Management → Create New Key
Track	Each key displays its last-used timestamp so you can identify stale keys
Revoke	Click Revoke on any individual key — other keys are not affected
Rotate	Create a new key, update your integration, then revoke the old key

Create a separate API key for each integration. This way you can revoke access for a single integration without disrupting others — for example, if a third-party tool is compromised or decommissioned.

Storing keys securely

Store your API key as an environment variable and read it at runtime. Never hardcode it in your source files.

# .env — never commit this file
APPSTLE_API_KEY=apst_your-api-key-here

// Read from environment at runtime
const apiKey = process.env.APPSTLE_API_KEY;

Authentication errors

If your request is rejected due to authentication, you will receive a 401 Unauthorized response:

{
  "error": "Unauthorized",
  "message": "Invalid API key provided",
  "status": 401
}

Common causes:

The key was revoked from the dashboard
The key was copied with extra whitespace
The X-API-Key header is missing from the request
You are using a key that belongs to a different store

Partner integrations

If you are building a product that integrates with Appstle Memberships (a CRM, helpdesk, email platform, or automation tool), you can apply for a Partner Key. Partner integrations bypass the paid API plan requirement, making it free for merchants to use your integration. Partner authentication uses two headers:

X-API-Key: <merchant-api-key>
X-App-Key: <your-partner-key>

The merchant provides their API key through your integration settings, and Appstle provisions your partner key once during onboarding — it is the same key for all merchants using your integration. To apply, contact support@appstle.com.

Direct API access (without a partner key) requires an active API plan. Contact support@appstle.com for pricing details.

Get Started

Guides

Partner Integration

Webhooks

Admin API

Customer Portal API

Authenticate with the Appstle Memberships API

Creating an API key

Sending the API key

Key format

Key management

Storing keys securely

Authentication errors

Partner integrations

​Creating an API key

​Sending the API key

​Key format

​Key management

​Storing keys securely

​Authentication errors

​Partner integrations

Creating an API key

Sending the API key

Key format

Key management

Storing keys securely

Authentication errors

Partner integrations