API keys

Every Storefront request carries an API key. The key tells Petanque AI which company is calling, so it decides whose products, customers and orders the request can reach.

What a key looks like

psk_<keyId>.<secret>

Send it in the x-storefront-token header:

GET /api/website/products HTTP/1.1
Host: api.petanqueai.com
x-storefront-token: psk_...

Keep the key on your server

A key can place orders and read payments for your company. Never put it in browser JavaScript, a mobile app bundle or a public repository. Call the API from your server and pass only the result to the browser.

Create a key

1. In Petanque AI, open Ayarlar → Web Sitesi (Settings → Web site). You need the storefront management permission.
2. Choose Yeni anahtar oluştur (Create a new key).
3. Give it a name (1 to 80 characters), for example production web site, and optionally an expiry date.
4. Copy the key. It is shown only once. Petanque AI keeps only a fingerprint of it, so a lost key cannot be shown again; create a new one instead.

A company can hold up to 10 active keys at a time. Revoked and expired keys do not count.

Rotate a key

Use a second key to change keys without downtime:

1. Create a new key.
2. Deploy your site with the new key.
3. Revoke the old key once no traffic uses it.

Revoke a key

Revoke a key from the same screen as soon as you stop using it or suspect it leaked. Requests with a revoked key are refused immediately.

When a key is refused

A missing, malformed, revoked or expired key is answered with HTTP 401. Check that the header name is x-storefront-token, that the whole key was copied, and that the key is still active in Ayarlar → Web Sitesi.