API keys and webhooks

Only the store owner can open Developers, and it unlocks when your plan is active. API keys grant access to your store's data, so staff cannot be given this page.

Create an API key

1. Open Developers and go to API keys.
2. Give the key a name, such as Production backend.
3. If you have a password on your account, enter it.
4. Create the key and copy it straight away.

The full key is shown once and we keep only a hash of it, so it cannot be shown again. Keep it on your server, never in a browser. Send it with every request as a Bearer token in the Authorization header. Press Revoke on a key to end it.

What the API can read

The API is read only. It answers in JSON and pages with limit and cursor. The API reference at the bottom of the page shows your base URL.

• GET /orders, which can filter by status, from and to.
• GET /orders/{id}.
• GET /subscriptions.
• GET /subscriptions/{id}.
• GET /products.

Add a webhook endpoint

Enter your URL, pick the events you want and add the endpoint. The events are order.created, refund.created and subscription.canceled. We POST a signed JSON event to your URL when one happens.

The signing secret is shown once, when you add the endpoint. Check the X-Sling-Signature header on each event: it is an HMAC SHA256 of the timestamp, a dot and the body, made with that secret.

Manage an endpoint

Each endpoint shows its events, whether it is active, recent failures and its last delivery. It has a test ping, and you can pause, resume or remove it.