Skip to main content

API Key Authentication

Every WordPress site you add to StorePilot receives a unique API key. This key is used by the WordPress plugin (and the browser tracker script) to authenticate ingest requests sent to the Platform.

Where to Find Your API Key​

  1. Log in to the Platform dashboard
  2. Go to Sites
  3. Click on your site name
  4. The API key is shown under the Settings tab

The key is a UUID-style string, for example:

5f3a2b1c-8e4d-4f9a-b7c6-1a2b3c4d5e6f

How the Key Is Used​

The WordPress plugin sends the API key in the X-StorePilot-Key request header on every ingest call:

POST /ingest/errors HTTP/1.1
Host: api.store-pilot.net
X-StorePilot-Key: 5f3a2b1c-8e4d-4f9a-b7c6-1a2b3c4d5e6f
Content-Type: application/json

{ "message": "...", "source": "...", ... }

The Platform validates the key on every request and resolves the associated siteId. If the key is missing or invalid, the request is rejected with 401 Unauthorized.

Protecting Your API Key​

The API key is embedded in the browser-side tracking script (so it is technically visible in page source). This is by design — ingest endpoints are write-only and accept only event data. They cannot be used to read data from the Platform.

To further limit risk:

  • The Platform only accepts ingest requests from the origin domain registered for the site
  • Rotating the key immediately revokes the old one

Rotating the API Key​

  1. Dashboard → Sites → [Site] → Settings
  2. Click Regenerate Key
  3. The new key is shown once — copy it immediately
  4. Update the API Key field in StorePilot → Settings in WordPress Admin
caution

Rotating the key will cause all ingest requests to fail until the new key is entered in the Plugin Settings.

Dashboard Authentication (JWT)​

The Platform dashboard uses a separate JWT-based authentication (not the API key). Dashboard users log in with email/password and receive:

  • An access token (short-lived, 15 minutes) stored in memory
  • A refresh token (7 days) stored in an HttpOnly cookie

This separation ensures that even if an API key is leaked, an attacker cannot log in to the dashboard.