API Authentication

To interact with the StoreLinkr REST API, you must authenticate your requests using two custom HTTP headers. These headers identify your application and ensure that you have permission to access the requested data.

Required Headers

Every request to the StoreLinkr API must include the following headers:

Header	Description
X-StoreLinkr-Api-Key	Your unique API Token.
X-StoreLinkr-Api-Secret	Your private API Secret.

Obtaining Your Credentials

You can manage your API credentials within the StoreLinkr dashboard.

1. Go to Settings > API Keys.
2. Create a new set of keys or use an existing one.
3. Your API Token corresponds to X-StoreLinkr-Api-Key.
4. Your API Secret corresponds to X-StoreLinkr-Api-Secret.

warning

Protect your API Secret! The secret should never be shared publicly, committed to version control, or exposed in client-side code (like JavaScript running in a browser). If you suspect your secret has been compromised, revoke the key immediately in the dashboard.

API Key Scopes

Each API key can be limited to a set of scopes — the actions it is allowed to perform. This lets you hand out a key that can, for example, only read stock, without giving it permission to change your catalog or read orders.

• By default a new key can do everything. If you leave the scopes empty ("All actions"), the key has full access to the API.
• As soon as you select one or more scopes, the key is restricted to only those actions. Any request outside its scopes is rejected with a 403 Forbidden.

You manage scopes per key under Settings > API Keys — click a key and tick the actions it may perform.

Available scopes

Scope	Allows
catalog:read	Read products, categories, variants and feeds.
catalog:write	Create, update and archive products and categories.
ecommerce:read	Read sales-channel products and product rules.
ecommerce:write	Create, update and delete product rules.
orders:read	Read orders.
orders:write	Create orders.
stock:read	Read stock information and stock mutations.

tip

Grant the least access a key needs. A key used only to read stock levels should have just stock:read.

Example Requests

Using cURL

curl -X GET "https://api.storelinkr.com/api/v2/products" \
     -H "X-StoreLinkr-Api-Key: your_api_token_here" \
     -H "X-StoreLinkr-Api-Secret: your_api_secret_here" \
     -H "Accept: application/json"

Using PHP (Guzzle)

use GuzzleHttp\Client;

$client = new Client();
$response = $client->request('GET', 'https://api.storelinkr.com/api/v2/products', [
    'headers' => [
        'X-StoreLinkr-Api-Key' => 'your_api_token_here',
        'X-StoreLinkr-Api-Secret' => 'your_api_secret_here',
        'Accept' => 'application/json',
    ]
]);

$body = json_decode($response->getBody(), true);

Troubleshooting Authentication

If you receive a 401 Unauthorized response:

• Double-check that both X-StoreLinkr-Api-Key and X-StoreLinkr-Api-Secret headers are present and correctly spelled.
• Verify that the values match exactly what is shown in the StoreLinkr dashboard.
• Ensure the API key has not been revoked.
• Check that you are sending the headers with the correct case (though HTTP headers are generally case-insensitive, following the standard casing is recommended).