Authentication

API Keys

All API requests must include a Bearer token in the Authorization header.

Authorization: Bearer bk_YOUR_API_KEY

Key scopes

Customer Sessions

For stores building customer-facing forms, issue a short-lived token:

POST /api/v1/customer-sessions
Authorization: Bearer bk_YOUR_STORE_KEY

{
  "customer_email": "customer@example.com"
}

// Response:
{
  "token": "eyJhbGci...",
  "expires_at": "2026-04-23T01:00:00.000Z",
  "customer_email": "customer@example.com"
}

The returned JWT expires in 1 hour and can be used as a Bearer token by the customer to call POST /api/v1/submissionson your store's behalf.

Tier Requirements

API access requires a Pro plan or higher. Starter and Free stores cannot authenticate via API keys.

Rate Limits