Shoplift API Key

Get and manage your API key

Your API key authenticates every request to the Shoplift API. Each store has one active key, and the key grants full write access to that store's tests, audiences, and campaigns.

Find your key

1. In the Shoplift dashboard, go to Settings.

2. Open the API tab in the top navigation.

3. Your key appears in the API key card, masked by default. Click the eye icon to reveal it, or the copy icon to copy it to your clipboard.

The card also shows when the key was created and when it was last used, which is useful for checking whether an integration is actually making requests.

Use your key

Include the key as a Bearer token in the Authorization header of every request:

Authorization: Bearer sl_live_<your-api-key>

Requests without a valid key return 401 Unauthorized.

Rotate your key

If your key may have been exposed, or as part of routine credential hygiene, rotate it:

1. On the API page, click Rotate key.

2. A new key is generated, and your old key stops working immediately.

Rotation is instant and has no grace period. The moment you rotate, every integration, script, and AI workflow using the old key will start failing with 401 Unauthorized. Have a plan to update your integrations with the new key before you rotate, not after.

The upside of instant invalidation: if a key leaks, rotating it cuts off access immediately.

Keep your key secret

Your API key can create, launch, and end tests on your live store. Before you put it anywhere, think through who and what can read it:

• Anything exposed in client-side code or a public repository is effectively public.

• Files on disk, including .env files, are readable by any tool or process you grant access to that directory.

• When you give an AI assistant or third-party tool access to your key, you're trusting that tool with full write access to your store's testing program.

There's no undo on a leaked key. If you're unsure whether a key has been exposed, rotate it.

Still need help?

Contact the Shoplift support team if you have questions about your API key.