Commstate
Start free
All features

Connect your own systems to your shop.

API keys for your integrations and webhooks for your order events. You make them in your admin, and you can stop them there too.

Start free for 14 days Talk to us

Your first API call, ready to paste.

The Developer section of your admin shows your base URL, your shop's header value and a ready curl. It is written for your shop, not an example one.

  • Your shop's base URL
  • Your X-Tenant value
  • A ready curl for your first call
  • How sign-in and rate limits work

A key for each integration.

Give an integration its own key instead of someone's login. Name it, tick what it may do and set when it expires.

  • Works in one shop only
  • Every key expires, 365 days at most
  • Shown once, with a copy button
  • Revoke stops it at its next request
  • Keys begin csk_, so a leak is easy to find

A key does only what you gave it.

Each scope is a permission, and a member can only give what they hold. Read-only permissions are ticked to start with, so writing is a choice.

  • Scopes grouped by area
  • Keys cannot change team or billing
  • Keys cannot change settings or connect stores
  • Keys cannot reach AI or workflow routes
  • A scope counts only while its module is on

Read and write over plain HTTP.

Send the key in a header with your shop's value, ask for JSON and go. Each request needs a scope that matches the route.

  • Authenticate with X-Api-Key and X-Tenant
  • JSON responses
  • A team member's token works as well
  • Past the limit you get 429 and Retry-After

Owners know when a key is made.

Making a key takes a permission, a password and a two-factor code if you use one. Every owner gets an email.

  • Owners and admins can make keys
  • All your keys on one screen
  • See who made it and when it was last used
  • Owners are told when a key's maker leaves
  • Activity is recorded against the key

Hear about orders as they change.

Add your URL, name your events and the shop calls you when something happens to an order. Set a secret and each call is signed.

  • Created, cancelled, fulfilled and delivered
  • Status, payment and shipment changes
  • An HMAC signature with your secret
  • A log of each delivery
  • Private addresses are refused

Build a storefront theme outside the admin.

A theme upload token does one job: upload a theme to your shop as a draft. It cannot reach anything else, and it never applies the theme.

  • Made from Storefront
  • Lasts 30 days unless you choose
  • 90 days at most
  • Listed beside your API keys
  • Revoke it from either screen

And the small things that matter.

  • HTTP steps in workflows

    A workflow can call another system as one of its steps.

  • Keys outlive people

    An integration keeps running when the person who set it up leaves.

  • Each key has its own limit

    120 requests a minute by default.

  • Failed attempts are limited

    Repeated wrong keys from one address get a 429.

  • One credential at a time

    A request with both a key and a bearer token is refused.

  • Switch it off

    A shop that turns off Developer closes its pages, and its keys stop.

Common questions

Which plan includes the API and webhooks?

Growth and up include API access and webhooks.

How many API calls do I get?

Growth includes 50,000 calls a month and Business 250,000. Enterprise has no limit. The free trial has 10,000.

Is there a GraphQL API for shop data?

Not yet. Use the REST API for orders, products and customers today.

Can an API key do everything a person can?

No. A key can do its scopes and nothing else. It can never manage your team, billing or settings.

What happens if I lose a key?

It cannot be shown again. Revoke it and make another.

Try it on your next order.

Connect your store and let one order run through. 14 days free, no card.

Start free for 14 days Talk to us