Authentication

Every app in your workspace has its own API key. Find it in the console under your app's row in Settings › Integrations › Shopify Partners (each tracked app lists its key).

Send it on every request:

X-Api-Key: <your app's API key>

Rules:

• The key identifies the app, so requests never need an app slug when the key is present.
• Keep it server-side only. Never ship it in frontend code, app bridge scripts, or mobile clients.
• One key per app: if you run multiple apps, each uses its own key and its data stays separated.
• A wrong or missing key returns 401 {"error": "invalid API key"}.

If a key leaks, rotate it from the console and update your backend's environment variable.

Responses

A successful write returns 200 with a small JSON body. Errors use the standard codes: 400 (bad request), 401 (bad key), 404, 429 (rate limited, back off and retry).

Enrichment is not part of your critical path, so make every call server-side and best-effort: run it from a background job or wrap it so a PartnerConsole error, timeout, or outage never blocks or breaks the merchant action that triggered it.