An API key is a secret key that allows you to use the Admin API and the Storefront API to get or change information in your store: products, categories, user profiles, orders, and so on. All keys are managed from one page in the Admin area.

You can access this page from Settings > API. The page itself is titled API Keys.

The Admin API and Storefront API links in the page's intro text lead to the API pages of your own store (/api and /api?section=storefront).

Each key has a scope that defines what it can do:

Give an integration the narrowest scope it needs. Treat read & write keys like an administrator password: anyone who has the key can change your store.

The key is shown only once.

X-Cart does not keep the key itself, only its protected hash, so it cannot be shown again or recovered. If you lose a key, delete it and create a new one.

Keys are generated automatically (128 characters); you cannot enter your own.

The table shows all keys of your store:

Keys that X-Cart creates for its own internal needs are not shown in this list.

For each key you can:

Both changes are applied after you click Save changes.

You cannot change the expiration date of an existing key. To extend access, create a new key and update your integration to use it.

When a key expires, it stops working immediately, and any integration that uses it loses access to your store. A switched-off key does not work either.

X-Cart checks your keys once a day. If a key expires within a week, X-Cart emails the store administrator (the first address in the Site administrator field of your store settings) with the subject "Action required: API keys are about to expire". The email lists the keys that are about to expire and their dates. Each key is reported once, and the notification cannot be disabled, because an expired key stops working immediately.

The notification is listed as API keys are about to expire in Settings > Email Notifications.

An expired key you created stays in the list for one more month, so you can see why an integration stopped working, and is then removed automatically.

To keep an integration running, create a new key before the old one expires and update the integration.

If your store has the Zapier add-on enabled, the access token is no longer set in the add-on's settings. The settings page shows a note instead: create a key on the API Keys page with scope Admin API - read only or Admin API - read & write, and use it in Zapier.

If your store used API keys before this page appeared, they were moved to the API Keys page during the update:

Moved keys get an expiration date 12 months after the update. If a former token was short (less than 32 characters), the key lives only one month: replace it with a new generated key before it expires. Keys that were tied to administrator profiles were not moved: such keys no longer exist, and you need to create new ones on this page.

Keep track of the expiration dates of the moved keys and create new keys before they expire.

Q: Where can I read about the API itself?

A: See the X-Cart API documentation.