Authentication
Shoprocket has two API surfaces and two kinds of key. The right one to reach for depends on where your code runs.
Public key vs secret key
Both keys live in your dashboard under Settings → API. Each store has its own set, and you can rotate either at any time.
| Key | Prefix | Where it runs | What it can do |
|---|---|---|---|
| Public | pk_live_… | Browser, mobile app, any untrusted client | Read the catalogue, manage a cart, submit checkout |
| Secret | sk_live_… | Your server only | Everything: create products, read orders, issue refunds |
Never ship a secret key to the browser
Public requests
Public (storefront) requests carry the publishable key in the URL path. No Authorization header is needed - the key is designed to be public.
curl https://api.shoprocket.io/v3/public/pk_live_123/productsPrivate requests
Private (admin) requests carry the secret key as a bearer token. These run on your server, against the private base URL.
curl https://api.shoprocket.io/v3/private/products \
-H "Authorization: Bearer sk_live_456"Cart tokens
A shopper's cart is identified by a cart token you generate once per visitor and send with public cart requests. Any opaque, random string works; keep it in a cookie or local storage so the cart survives a page reload.
curl https://api.shoprocket.io/v3/public/pk_live_123/cart \
-H "X-Cart-Token: 8f3c1a9e-…"Keeping keys safe
- Never commit a secret key to source control or ship it to the browser.
- Use environment variables on the server; use the publishable key in client code.
- Roll keys from the dashboard if you suspect exposure - it's instant.
Next: embed the widget or read the REST API reference.