API keys
API keys are created from the StoreInspect dashboard by paid-plan accounts with API access enabled. Keep keys server-side. Do not put them in browser code, mobile apps, public repos, client logs, or query strings.Request IDs
Every API response includes anX-Request-Id header and a request_id field in the JSON body.
Include the request ID when contacting support.
Key safety
- Store keys in environment variables or a secret manager.
- Use separate keys for separate integrations.
- Rotate a key immediately if it may have been exposed.
- Never log raw API keys.