API keys & scopes
Create a crmk_ key, choose scopes, and authenticate requests.
Server-to-server access (including the MCP server) uses an organization API
key, prefixed crmk_.
Create a key
In the admin, open Settings → API keys and create a key. Choose the minimum scopes the integration needs, then copy the key — it's shown once.
Scopes
| Scope | Grants |
|---|---|
products:write | Create/update products, attributes, attribute sets, categories. |
webstore:write | Themes, sections, pages, blog, menus, collections, content, translations. |
settings:write | Global settings, the commerce toggle, cache, store configuration. |
Read access to the data those areas expose is included with the corresponding write scope. A key always resolves to its own organization/store — it can never act on another tenant.
Authenticating
Send the key as a bearer token:
curl https://<your-host>/graphql \
-H "Authorization: Bearer crmk_xxxxxxxxxxxxxxxxxxxxxxxx" \
-H "Content-Type: application/json" \
-d '{"query":"{ __typename }"}'Keep keys secret
Never embed a crmk_ key in client-side code or commit it to a repo. Use
environment variables / a secrets manager. Rotate keys you suspect are leaked.
Browser sessions
The admin UI authenticates with a session cookie instead of a key — see Authentication.