Build anything on Shoprocket

Drop-in widget, REST API, and webhooks - the same backend that powers the dashboard, same catalogue model, no lock-in.

Embed the widget

Drop Shoprocket into any site, CMS, or builder. One script tag and your store is live.

Authentication

Publishable keys for storefronts, secret keys for your server. Headers and rate limits you need to know.

Webhooks

Subscribe to order, cart, and product events. Verify signatures, handle retries, build sync jobs.

REST API

Cart, products, checkout, orders, customers. The full HTTP reference with request and response examples.

How it fits together

Every Shoprocket store has three things you interact with as a developer:

The widget. A JavaScript bundle you embed on your own site. Handles catalogue, cart, and checkout UI, and calls the public API under the hood. You never touch that API directly unless you want a fully headless build.
The public API. The browser-safe API the widget speaks. Read products, manage a cart by token, submit checkout. Anyone can call it from a browser with a publishable key.
The private API. The authenticated API for your own server-side integrations. Create products, manage inventory, read orders, push updates from your ERP - whatever you need.

Starting from scratch?

Most integrations begin with the widget - add the script tag, and your catalogue and checkout are live. You only need the APIs when you want something the widget doesn't already handle.

Base URLs

API	Base URL	Auth
Public	`https://api.shoprocket.io/v3/public`	Publishable key (pk_)
Admin (private)	`https://api.shoprocket.io/v3/private`	Secret key (sk_)

All requests are HTTPS only and both APIs return JSON. Public endpoints are safe to call from the browser; private endpoints must only be called from your server, since your secret key must never reach a client.