Authentication
Publishable keys, the sites they work on, and what they can do.
Every request carries the shop's publishable key as a bearer token:
GET /v1/storefront/shop HTTP/1.1
Host: api.cashiar.app
Authorization: Bearer pk_live_Fd8sK2qX9mVb1LnP4rT7wY0zGetting a key
The shop's owner (or anyone allowed to change Settings › Online store) opens Settings › Developers in Cashiar:
- Create key makes the shop's key. A shop has one key at a time.
- Copy puts it on the clipboard.
- Regenerate makes a new key. The old key stops working at once, so update your site or app straight away.
The Online store add-on must be on, and the store open, for the API to answer.
What a key can do
A publishable key is safe in a browser, a mobile app or any public code. It can only do what a customer on the shop's store can do:
| It can | It cannot |
|---|---|
| Read the shop, its products, prices and stock | See costs, suppliers, staff or other customers |
| Read services and their free times | Change products, prices, stock or settings |
| Place orders and bookings | See or change other orders, except one it placed |
| Read an order it placed, by the order's id | Refund, void or take payments |
Allowed sites
By default any website may use the key. To keep it to your own, list your sites under Allowed sites in Settings › Developers, one per line:
https://www.amashop.com
https://amashop.comA browser request from any other site then gets 403 Forbidden. Mobile apps and servers send no Origin header, so the list doesn't limit them; the key alone decides.
Never put a key in a URL
Send the key in the Authorization header only. A key in a URL ends up in browser history and server logs.
CORS
The Storefront API answers browsers on any site (Access-Control-Allow-Origin echoes your origin) and uses no cookies. You don't need a proxy: call it straight from your frontend.
Errors
| Status | When |
|---|---|
401 Unauthorized | No key, a malformed key, or a key that was regenerated. |
403 Forbidden | The key is used from a site not in its allowed sites. |
404 Not Found | The shop has no Online store add-on, or Cashiar has paused it. |