Developers
Sign in

Developers

Checkout, digital delivery and store APIs.

Manage API keys

Authentication

All authenticated API endpoints require a Store API Key passed in the Authorization header.

Authorization: Bearer <your_store_api_key>

API Key Types

TypeAuthenticationUse
Store API Key Bearer token Server-to-server: checkout sessions, licensing fulfillment
Public endpoints None Geo subdivisions, tax rates (no key required)

Managing Keys

Choose Manage API keys and open the appropriate store. Use a Creativemark store key, not a Stripe key. Keep it in a server environment variable such as CREATIVEMARK_API_KEY, grant only the scopes your integration needs, and revoke unused keys.

Security Best Practices

  • Never expose API keys in client-side code or public repositories
  • Use environment variables to store keys in your application
  • Rotate keys regularly and revoke unused keys
  • Use HTTPS for all API requests