Commerce API / Get started
Authentication
Every connection belongs to one store. Send its API key with each request.
Authorization: Bearer stc_YOUR_API_KEY
Two credentials, two jobs
API key
Lets your server call Storlio. The dashboard shows only its prefix after
creation.
Webhook signing secret
Verifies messages sent from Storlio to your website. It is shown once.
Keep access under control
- Keep both secrets on your server, never in browser code.
- Replace a lost key or signing secret independently in store settings.
- Replacing a key invalidates the old one immediately. Keys expire within one
year.
- Revocation stops access and webhooks; imported products remain.
Permissions
products:readRead products
products:writeCreate and update products
inventory:readRead stock
inventory:writeUpdate stock
checkout:writeCreate checkout links
orders:readRead store orders