Overview

Authentication

Get and use API keys.

Getting an API key

  • Open the API keys page in your dashboard
  • Click Create API Key
  • Copy the key immediately - it won't be shown again
These are publishable keys, prefixed pk_. They are safe to embed in browser or mobile client code: they cover your public storefront data and the client-side actions a shopper performs, such as creating a cart. A publishable key cannot read private data or make administrative changes to your store, like editing products, settings, or orders.

Using your API key

Include the key in the Authorization header:

curl https://api.getaeolian.com/v1/products \
  -H "Authorization: Bearer pk_your_api_key"

Each key is scoped to a single store - you don't need to specify a store ID in requests.

Calling from the browser

The API sends permissive CORS headers, so you can call it directly from storefront frontend code. Browsers send a preflight OPTIONS request automatically and no extra setup is needed.

Call publishable keys from the browser, not from your own server. The API is rate limited per client IP, so calling from the browser gives each shopper their own budget. Routing every request through a single server IP shares one bucket and gets throttled quickly under real traffic. See Rate Limits.

Pausing keys

You can pause an API key from the dashboard without deleting it. Paused keys are rejected during authentication - requests will return a 401 with Invalid API key.

This is useful for temporarily disabling access (e.g., during maintenance or if you suspect a leak) while keeping the option to re-enable later.