Skip to main content
StoreInspect API requests use Bearer authentication.

​
Key handling

  • Store API keys in server-side environment variables.
  • Do not send API keys in query strings.
  • Use separate keys for separate integrations when possible.
  • Rotate keys immediately if they are exposed.
API key creation and all data endpoints are paid-plan gated. Existing valid keys can still read billing status and create Stripe-hosted recovery or upgrade links after paid data access lapses. Public docs and /openapi.json remain accessible without an API key.

​
MCP authentication

MCP clients do not use StoreInspect API keys. Use the hosted MCP server and complete OAuth in your browser:
See the MCP quickstart for ChatGPT, Claude, Codex CLI, Cursor, VS Code, and other MCP clients.

​
Request IDs

Every API response includes an X-Request-Id header and a request_id field in the JSON body. Include the request ID when contacting support.
StoreInspect request logs are privacy-safe. They do not store raw API keys or revealed contact channels.