Let your ERP or app read your store

What this page is for

An API key is a long password for software, not for people. Your accountant's tool or your developer's script sends it with every request to read your store's data.

Keys can read your catalogue at retail prices, your orders and your returns. Wholesale prices are never sent through the API, whatever the key. The only thing a key can write is store credit, and only if you allow it.

You need the Manage settings permission. Keys can't be made while support is signed in to your store.

Create a key in 4 steps

1. 1

   Name the key

   API keys → Key name

   Use a name that says who uses it, like ERP sync or Ramesh's Tally connector. You will see this name in the list later.

2. 2

   Tick only what it needs

   The scope boxes under the name

   Catalog (read) is ticked to start. Add Orders (read), Returns (read) or Store credit (read) only if the tool needs them.

   Store credit (write) lets the tool give store credit, which is money. Tick it only for a tool you fully trust. You need the Edit customers permission to make such a key.

3. 3

   Create and copy the key now

   Create key → Copy

   Tap Create key. A green box shows the key once. Tap Copy and paste it into the other tool straight away.

   The key is never shown again. If you lose it, revoke it and create a new one.

4. 4

   Use it as a Bearer token

   The other tool

   The tool sends Authorization: Bearer followed by the key, to addresses like /api/v1/products and /api/v1/orders on your store. The Last used column shows when it was last used.

What each scope allows

• Catalog (read): products at retail prices — never wholesale.
• Orders (read): your orders with their totals as they were when placed.
• Returns (read): return requests with the amounts the buyer paid; no photos or videos unless asked for.
• Store credit (read): a customer's store-credit balance and its history.
• Store credit (write): give a customer store credit, with a reason. A retry with the same idempotency key gives the credit only once.

What the fields on this page mean

Scopes

What the key may read (or, for store credit, write). A key can do nothing outside its scopes.e.g. A stock-sync tool needs only Catalog (read).

Key created

The green box after Create key, with the full key. It shows only this once; Slaby keeps just a scrambled copy.e.g. Copy it into the ERP now, before leaving the page.

Key

The key's name and its first few characters, so you can tell keys apart without the full key.e.g. ERP sync, with the first 10 characters of its key under the name.

Last used

When a request last came in with this key. Never means it hasn't been used yet.e.g. A key last used 8 months ago is probably safe to revoke.

State

Active keys work. Revoked keys stop working at once and can't be switched back on.e.g. Revoked after a staff member leaves.

One key per tool Make a separate key for each tool or person. Then, if one leaks or a contract ends, you revoke just that key and nothing else stops working.

Read next

• Store API guideEndpoints, examples and limits.
• WebhooksGet told the moment an order is placed.
• Tally exportSend bills to Tally without the API.
• Export & backupDownload everything as Excel instead.

Common questions

I lost my key. Can I see it again?

No. Slaby keeps only a scrambled copy. Revoke the old key and create a new one.

Can the API show my wholesale prices?

No. The catalog is always sent at retail prices, so trade prices never leave through an API key.

Can a key change my products or orders?

No. Keys are read-only, except Store credit (write), which can only give a customer store credit.

It says I don't have the permission for a scope.

You can only give a key powers your own role has. Store credit (write) needs Edit customers. Ask the owner, or untick that scope.

How many requests can a key make?

120 per minute by default. Requests above that are refused for a moment; the tool should slow down and retry.

How do I stop a tool using my store?

Tap Revoke on its key and confirm. Anything using that key stops working at once. This can't be undone.

What address does the API use?

Your store's own address followed by /api/v1/…, for example /api/v1/products and /api/v1/orders. The Store API guide lists them all.

Can I connect Tally with an API key?

Yes, with a Tally connector that reads the API. Or skip the API: download the Tally file from Reports, as set up on the Tally export page.