API keys and scopes
Create, rotate, revoke, and scope store API keys.
Open Developers → API keys. Store API keys can be created, listed, disabled, deleted, patched, and rolled. Newly created or rolled secrets are shown once.
Scopes are exposed by GET /v1/stores/{storeId}/api-keys/scopes and enforced by route permissions. Use the narrowest scope that can perform the job.
Store API keys are store-scoped. Dashboard sessions and API keys may both appear as security options in the OpenAPI reference, but session-only account/admin routes are not included in the public docs.