API Settings

Every store and network in Storefront has a unique public key that authenticates requests from your customer-facing app (mobile or web). The key is passed as a bearer token in the standard HTTP Authorization header.

Navigate to Storefront → Settings → API to view your store's key.

Your Store Key

The store key is auto-generated when the store is created. It follows the format store_<hash> (e.g., store_a1b2c3d4e5f6...).

This key is public — it is safe to include in your mobile app or web frontend. It identifies which store the request is for; it does not grant admin access.

GET /storefront/v1/products
Authorization: Bearer store_a1b2c3d4e5f6

Network Key

If you operate a network, the network key follows the same pattern: network_<hash>. Use the network key to fetch stores, categories, and other network-level resources.

GET /storefront/v1/stores
Authorization: Bearer network_a1b2c3d4e5f6

Authenticated Customer Requests

For requests that require an authenticated customer (cart, checkout, profile, addresses, orders), include the customer's session token in the Customer-Token header in addition to the storefront bearer token:

const response = await fetch('https://your-fleetbase-instance.com/storefront/v1/checkouts/before', {
  method: 'POST',
  headers: {
    'Authorization': 'Bearer store_a1b2c3d4e5f6',
    'Customer-Token': '1|VlKK7lZ...',
    'Content-Type': 'application/json'
  },
  body: JSON.stringify({ /* ... */ })
});

The Customer-Token is the Sanctum personal access token returned by the customer login endpoints — see Customer Authentication.

Key Rotation

Because the key ships inside your app, anyone can extract it. If a key is being abused, for example to send one-time codes in bulk through POST /storefront/v1/customers/request-creation-code, rotate it. Rotating issues a new key and the old key stops working immediately: every request that sends it is rejected with 401 until the app is updated.

Key rotation is available from Storefront v0.4.25.

From the console

Rotating requires the rotate-key action on the store or network resource of the Storefront permission schema (storefront rotate-key store / storefront rotate-key network). Administrators can always rotate, and the MarketplaceManager policy covers networks. On a self-hosted upgrade, re-run permission seeding so the new permissions exist.

From the API

The console calls an internal endpoint, scoped to the signed-in user's organization:

POST /storefront/int/v1/stores/{id}/rotate-key
POST /storefront/int/v1/networks/{id}/rotate-key

{id} is the store or network uuid or public ID. The response contains the new key:

{ "status": "ok", "key": "store_9f2c4e1a7b..." }

From the command line

For incident response on a self-hosted instance, the storefront:rotate-key artisan command rotates keys in bulk and prints each old and new key:

# Specific stores or networks, by uuid, public ID or the current (abused) key
php artisan storefront:rotate-key store_a1b2c3d4e5f6 network_xyz123

# Every store and network of an organization (uuid or public ID)
php artisan storefront:rotate-key --company=company_abc123

# Skip the confirmation prompt, e.g. in a script
php artisan storefront:rotate-key --company=company_abc123 --force

The command looks up every target before changing anything, so an unknown ID rotates nothing.