Find your store

Add-on

Partner API & Zapier

API keys for your partners and tools. Each key gets only the scopes you tick (orders, customers, products, wallets, winners), its own rate limit, an optional IP allowlist and an expiry; the secret is shown once and stored only as a hash. Partners read orders, customers, products and winners, update product price, stock and visibility, and add coins to wallets up to a daily cap, every write logged. Zapier and Make connect through REST hooks and polling triggers for new orders, customers and winners.

  • Version 1.0.14

Add-on

Buy and install it from Add-ons in your admin panel.

Buy now · $29.00 Choose a platform

Changelog

  1. Version 1.0.14 8 Nov 2026

    - No change in behaviour with the add-on's own "behind a proxy" setting off: a key's IP allow-list still checks the connection's own address, never a CF-Connecting-IP or X-Real-IP header the store's trusted-proxy setting would believe; the code now says why and a probe holds it.

  2. Version 1.0.13 4 Nov 2026

    - On a hosted Cloud plan, an API key adding a product is refused once the store reaches its plan's product limit (403 plan_limit), the same as the store's own forms. Changing existing products is never limited, and self-hosted stores are unaffected. Needs kernel support for plan limits to take effect; on an older kernel nothing changes.
    - For developers: this plugin now tells the coming Clear test data tool what to do with each of its tables (empty it, keep it, or remove it only with customer accounts). Nothing changes for store owners yet.
    - For developers: tells the coming Clear test data tool what to switch off or renew when it runs (keys made in test, hooks, signing secrets or customers' two-step rows). Nothing changes for store owners yet.
    - A key that can add coins to wallets now needs at least one allowed IP address, so a leaked key alone can no longer add coins. Keys saved before this keep working: the Partner API page shows a warning on each one, and every credit it makes is noted in the error log, until you add the partner's server addresses.

  3. Version 1.0.12 30 Oct 2026

    - This add-on's admin pages show an 'Online docs' link next to the page name, opening the “REST API and mobile app” page of the online documentation in a new tab.

  4. Version 1.0.11 29 Oct 2026

    - Amharic (አማርኛ) translation, machine-translated (review welcome).
    - Oromo (Afaan Oromoo) translation, machine-translated (review welcome).

  5. Version 1.0.10 26 Oct 2026

    - Adds Thai (ไทย). Machine-translated; review welcome.
    - Japanese translation.

  6. Version 1.0.9 25 Oct 2026

    - Adds Polish (pl) text. Machine-translated.

  7. Version 1.0.8 23 Oct 2026

    - After you rotate a key, its webhook subscriptions stay off until the partner subscribes again with the new key, even if a delivery was being sent at that moment.
    - Rotating a partner API key now switches off that key's webhook subscriptions, so an address subscribed with a leaked key stops receiving customer events; the partner subscribes again with the new key.
    - A product description sent through the partner API is now cleaned like the admin and seller forms clean it.
    - A queued winner notification is no longer sent with the winner's customer id after the key loses the read:customers scope.
    - IP allowlists: one malformed entry in TRUSTED_PROXY_IPS no longer disables the whole list, and a key allowlist that can't be read now blocks every address instead of allowing all.

  8. Version 1.0.7 20 Oct 2026

    - When a customer deletes their account, the credits partners gave them stay on record without their name, and still count toward each key's daily credit limit.