Skip to main content
StoreInspect API requests use Bearer authentication.

​
API keys

API keys are created from the StoreInspect dashboard by paid-plan accounts with API access enabled. Keep keys server-side. Do not put them in browser code, mobile apps, public repos, client logs, or query strings.

​
StoreInspect OAuth integrations

StoreInspect-managed integrations such as the Google Sheets add-on use OAuth instead of asking users to paste API keys. OAuth access tokens use the same Bearer header, endpoint scopes, paid-plan checks, quotas, and contact-credit ledger as API keys. The API OAuth resource is:
OAuth client registration and secrets are managed by StoreInspect. API developers building independent server-side integrations should continue to use dashboard-created API keys unless StoreInspect has approved an OAuth client for their integration.

​
Request IDs

Every API response includes an X-Request-Id header and a request_id field in the JSON body. Include the request ID when contacting support.

​
Key safety

  • Store keys in environment variables or a secret manager.
  • Use separate keys for separate integrations.
  • Rotate a key immediately if it may have been exposed.
  • Never log raw API keys.