Skip to main content
Every Admin API request must include an API key. You generate keys in your Appstle dashboard — they are never transmitted over the wire in full after creation, so store them securely as soon as you create them.
API keys are server-side only. Never include them in client-side JavaScript, mobile app source code, public repositories, or any environment where end users could inspect them.

​
Creating an API key

1

Open API Key Management

Log in to your Appstle admin panel and navigate to Settings → API Key Management.
2

Create a new key

Click Create New Key and give it a descriptive name that identifies the integration it belongs to — for example, Zapier Integration or Mobile App.
3

Copy the key immediately

The full key value is shown only once. Copy it now and store it in a secure location such as a secrets manager or environment variable store. You cannot retrieve it again after closing this dialog.
4

Add the key to your integration

Set the key as an environment variable in your server environment and read it at runtime. Never hard-code it in source files.
Create one key per integration rather than sharing a single key across systems. This lets you revoke access for one integration without disrupting the others.

​
Sending the API key

Include the key in the X-API-Key request header on every Admin API call:
API keys use the apst_ prefix. Existing legacy keys (created before the prefix was introduced) continue to work without any migration.

​
Query parameter alternative

You can also pass the key as a query parameter, though header-based authentication is recommended:

​
Managing keys

From Settings → API Key Management you can:
Each store can have up to 10 active API keys. If you need to create an 11th key, revoke an unused existing key first.

​
Partner integrations

If you are building a product that connects to Appstle on behalf of multiple merchants — for example a helpdesk, CRM, automation platform, or AI agent — use the Partner Integration Framework. If your application needs to call Appstle’s Admin API, use the framework’s Nonce Handshake connection mode:
1

Get your partner credentials

Appstle provides your Partner ID and Partner Secret during onboarding. Store the secret securely.
2

Start the merchant connection

Call the relevant /api/partner/{partnerId}/... endpoints and authenticate with X-Partner-Secret or the configured HMAC headers.
3

Wait for merchant approval

The merchant approves the request under Settings → Partner Connections in Appstle.
4

Receive the scoped API token

Appstle delivers a merchant-specific apst_... token to your approval callback.
5

Call the Admin API

Send the scoped token as X-API-Key, exactly like a regular API key. Your Partner Secret is only ever used for /api/partner/... connection calls — never send it to Admin API endpoints.
Scoped partner tokens bypass the paid API plan requirement. Merchants do not need their own Appstle API subscription to use an approved partner integration.

​
Storefront API authentication

The Storefront API does not use API keys. Instead, it relies on a customer’s active Shopify session (the customer must be logged in to the storefront). Requests are routed through Shopify’s App Proxy, which handles authentication automatically. See the Storefront API reference in the sidebar for endpoint details.