Spree Commerce API Keys API
Secret and publishable API keys
Work with this as data
Every API here is available over the APIs.io API and to AI agents over MCP.
MCP server
One button, every client — Claude, Cursor, VS Code and the rest.
https://apis.io/mcp
Tools for apis
7 MCP tools reach this
find_apisBrowse and filter every API in the catalog.get_api_artifactsOne API's artifacts, grouped by type.get_openapiThe primary OpenAPI for this API.find_similar_apisAPIs that look like this one.apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.resolveTurn a domain, URL or GitHub org into the provider it belongs to.find_cohortsEvery scored population of providers in the catalog.
Call it yourself
curl for this page
This API
curl "https://apis.io/api/v1/apis/spree-api-keys-api"
All apis
curl "https://apis.io/api/v1/apis?limit=25"Discovery needs no key. Ratings and market analysis are Pro.
OpenAPI Specification
openapi: 3.0.3
info:
title: Admin Account / Address API Keys API
contact:
name: Spree Commerce
url: https://spreecommerce.org
email: hello@spreecommerce.org
description: "Spree Admin API v3 - Administrative API for managing products, orders, and store settings.\n\n## Authentication\n\nThe Admin API requires a secret API key passed in the `x-spree-api-key` header.\nSecret API keys can be generated in the Spree admin dashboard.\n\n## Response Format\n\nAll responses are JSON. List endpoints return paginated responses with `data` and `meta` keys.\nSingle resource endpoints return a flat JSON object.\n\n## Resource IDs\n\nEvery resource is identified by an opaque string ID (e.g. `prod_86Rf07xd4z`,\n`variant_k5nR8xLq`, `or_UkLWZg9DAJ`). Use these IDs everywhere — URL paths,\nrequest bodies, and Ransack filters all accept them directly.\n\n## Error Handling\n\nErrors return a consistent format:\n```json\n{\n \"error\": {\n \"code\": \"validation_error\",\n \"message\": \"Validation failed\",\n \"details\": { \"name\": [\"can't be blank\"] }\n }\n}\n```\n"
version: v3
servers:
- url: http://{defaultHost}
variables:
defaultHost:
default: localhost:3000
tags:
- name: API Keys
description: Secret and publishable API keys
paths:
/api/v3/admin/api_keys:
get:
summary: List API keys
tags:
- API Keys
security:
- api_key: []
bearer_auth: []
description: 'Returns publishable and secret API keys for the current store. Secret keys are listed by `token_prefix` only — the plaintext token is delivered exactly once on create.
**Required scope:** `read_api_keys` (for API-key authentication).'
x-codeSamples:
- lang: javascript
label: Spree Admin SDK
source: "import { createAdminClient } from '@spree/admin-sdk'\n\nconst client = createAdminClient({\n baseUrl: 'https://your-store.com',\n secretKey: 'sk_xxx',\n})\n\nconst { data: keys } = await client.apiKeys.list()"
parameters:
- name: x-spree-api-key
in: header
required: true
schema:
type: string
- name: Authorization
in: header
required: true
schema:
type: string
responses:
'200':
description: API keys found
content:
application/json:
example:
data:
- id: key_UkLWZg9DAJ
name: Storefront key
key_type: publishable
token_prefix: null
scopes: []
created_at: '2026-06-12T17:23:45.015Z'
updated_at: '2026-06-12T17:23:45.015Z'
revoked_at: null
last_used_at: null
plaintext_token: pk_5AskmHCv2omYyoBr3mehREcX
created_by_email: null
- id: key_gbHJdmfrXB
name: Backend integration
key_type: secret
token_prefix: sk_qBGxwGooh
scopes:
- write_all
created_at: '2026-06-12T17:23:45.016Z'
updated_at: '2026-06-12T17:23:45.016Z'
revoked_at: null
last_used_at: null
plaintext_token: null
created_by_email: null
- id: key_EfhxLZ9ck8
name: minima
key_type: secret
token_prefix: sk_2bVt6n2wq
scopes:
- write_all
created_at: '2026-06-12T17:23:45.017Z'
updated_at: '2026-06-12T17:23:45.017Z'
revoked_at: null
last_used_at: null
plaintext_token: null
created_by_email: null
meta:
page: 1
limit: 25
count: 3
pages: 1
from: 1
to: 3
in: 3
previous: null
next: null
post:
summary: Create an API key
tags:
- API Keys
security:
- api_key: []
bearer_auth: []
description: 'Creates a publishable or secret API key. The plaintext token is included in the response **once** for secret keys; publishable keys expose their token on every read since they are intended for client-side use.
**Required scope:** `write_api_keys` (for API-key authentication).'
x-codeSamples:
- lang: javascript
label: Spree Admin SDK
source: "import { createAdminClient } from '@spree/admin-sdk'\n\nconst client = createAdminClient({\n baseUrl: 'https://your-store.com',\n secretKey: 'sk_xxx',\n})\n\nconst key = await client.apiKeys.create({\n name: 'Backend integration',\n key_type: 'secret',\n scopes: ['read_orders', 'write_orders']\n})\n// `key.plaintext_token` is available only on this response."
parameters:
- name: x-spree-api-key
in: header
required: true
schema:
type: string
- name: Authorization
in: header
required: true
schema:
type: string
responses:
'201':
description: secret key created — plaintext token returned once
content:
application/json:
example:
id: key_VqXmZF31wY
name: CI key
key_type: secret
token_prefix: sk_vGdftBeFe
scopes:
- read_orders
created_at: '2026-06-12T17:23:45.625Z'
updated_at: '2026-06-12T17:23:45.625Z'
revoked_at: null
last_used_at: null
plaintext_token: sk_vGdftBeFecVvHg1towF93knP
created_by_email: dirk_morar@ohara.info
'422':
description: validation error
content:
application/json:
example:
error:
code: validation_error
message: Name can't be blank and Scopes can't be blank
details:
name:
- can't be blank
scopes:
- can't be blank
requestBody:
content:
application/json:
schema:
type: object
required:
- name
- key_type
properties:
name:
type: string
example: Backend integration
key_type:
type: string
enum:
- publishable
- secret
scopes:
type: array
items:
type: string
example:
- read_orders
- write_orders
/api/v3/admin/api_keys/{id}:
get:
summary: Show an API key
tags:
- API Keys
security:
- api_key: []
bearer_auth: []
description: '**Required scope:** `read_api_keys` (for API-key authentication).'
x-codeSamples:
- lang: javascript
label: Spree Admin SDK
source: "import { createAdminClient } from '@spree/admin-sdk'\n\nconst client = createAdminClient({\n baseUrl: 'https://your-store.com',\n secretKey: 'sk_xxx',\n})\n\nconst key = await client.apiKeys.get('key_xxx')"
parameters:
- name: x-spree-api-key
in: header
required: true
schema:
type: string
- name: Authorization
in: header
required: true
schema:
type: string
- name: id
in: path
required: true
schema:
type: string
responses:
'200':
description: API key found
content:
application/json:
example:
id: key_UkLWZg9DAJ
name: Storefront key
key_type: publishable
token_prefix: null
scopes: []
created_at: '2026-06-12T17:23:45.944Z'
updated_at: '2026-06-12T17:23:45.944Z'
revoked_at: null
last_used_at: null
plaintext_token: pk_bZ5pTDmsuFozzLiikk62bCgQ
created_by_email: null
delete:
summary: Delete an API key
tags:
- API Keys
security:
- api_key: []
bearer_auth: []
description: '**Required scope:** `write_api_keys` (for API-key authentication).'
x-codeSamples:
- lang: javascript
label: Spree Admin SDK
source: "import { createAdminClient } from '@spree/admin-sdk'\n\nconst client = createAdminClient({\n baseUrl: 'https://your-store.com',\n secretKey: 'sk_xxx',\n})\n\nawait client.apiKeys.delete('key_xxx')"
parameters:
- name: x-spree-api-key
in: header
required: true
schema:
type: string
- name: Authorization
in: header
required: true
schema:
type: string
- name: id
in: path
required: true
schema:
type: string
responses:
'204':
description: API key deleted
/api/v3/admin/api_keys/{id}/revoke:
patch:
summary: Revoke an API key
tags:
- API Keys
security:
- api_key: []
bearer_auth: []
description: 'Marks the key revoked. Future requests using its token will fail; the row is preserved for audit.
**Required scope:** `write_api_keys` (for API-key authentication).'
x-codeSamples:
- lang: javascript
label: Spree Admin SDK
source: "import { createAdminClient } from '@spree/admin-sdk'\n\nconst client = createAdminClient({\n baseUrl: 'https://your-store.com',\n secretKey: 'sk_xxx',\n})\n\nconst key = await client.apiKeys.revoke('key_xxx')"
parameters:
- name: x-spree-api-key
in: header
required: true
schema:
type: string
- name: Authorization
in: header
required: true
schema:
type: string
- name: id
in: path
required: true
schema:
type: string
responses:
'200':
description: API key revoked
content:
application/json:
example:
id: key_gbHJdmfrXB
name: Backend integration
key_type: secret
token_prefix: sk_PVNjbM3kV
scopes:
- write_all
created_at: '2026-06-12T17:23:46.589Z'
updated_at: '2026-06-12T17:23:47.008Z'
revoked_at: '2026-06-12T17:23:47.006Z'
last_used_at: null
plaintext_token: null
created_by_email: null
components:
securitySchemes:
api_key:
type: apiKey
name: x-spree-api-key
in: header
description: Secret API key for admin access
bearer_auth:
type: http
scheme: bearer
bearerFormat: JWT
description: JWT token for admin user authentication
x-tagGroups:
- name: Authentication
tags:
- Authentication
- name: Products & Catalog
tags:
- Products
- Variants
- Option Types
- Custom Fields
- Channels
- name: Pricing
tags:
- Pricing
- Markets
- name: Orders & Fulfillment
tags:
- Orders
- Payments
- Fulfillments
- Refunds
- name: Customers
tags:
- Customers
- Customer Groups
- name: Promotions & Gift Cards
tags:
- Promotions
- Gift Cards
- name: Data
tags:
- Exports
- name: Configuration
tags:
- Settings
- Stock Locations
- Payment Methods
- Staff
- API Keys
- Allowed Origins
- Webhooks