API Keys & Authentication

Every request to the DashForDevs API requires an API key. There are two types of keys, each with different access levels and security requirements.

Key Types

Public Keys (pk_*)

Public keys are safe to use in client-side code. They can:

• List and search products, categories, brands
• Get product details, images, and variations
• Manage the shopping cart (add, update, remove items)
• Apply discount codes
• Create orders and process checkout
• Register and authenticate customers
• Submit contact forms
• Fetch blog posts and pages
• Get store global data (name, logo, settings)

Public keys cannot:

• Create, update, or delete products
• View or modify other customers' data
• Access order management or fulfillment
• Modify organization settings
• Access financial data or reports

Secret Keys (sk_*)

Secret keys have full access to everything. Use them only in server-side code:

• API routes (app/api/ in Next.js)
• Server components (with no client exposure)
• Backend services, cron jobs, webhooks

Environment Variables

Set up your keys in .env.local:

# Frontend (browser-safe)
NEXT_PUBLIC_DASH4DEVS_API_KEY=pk_live_your_key_here

# Backend (server-side only — NO NEXT_PUBLIC_ prefix)
DASH4DEVS_SECRET_KEY=sk_live_your_key_here

The NEXT_PUBLIC_ prefix tells Next.js to expose the variable to the browser. Never use this prefix for secret keys.

Using Both Keys

A typical setup uses two client instances:

// lib/dash.ts — public client for frontend
import { DashClient } from "dash4devs"

export const dash = new DashClient({
  apiKey: process.env.NEXT_PUBLIC_DASH4DEVS_API_KEY,
})

// lib/dash-server.ts — secret client for API routes only
import { DashClient } from "dash4devs"

export const dashServer = new DashClient({
  apiKey: process.env.DASH4DEVS_SECRET_KEY,
})

Generating Keys

1. Go to your dashboard at Settings > API > Keys
2. Click Generate Key
3. Choose the key type (Public or Secret)
4. Copy the key immediately — secret keys are only shown once
5. Add it to your .env.local file

Rotating Keys

If you suspect a key has been compromised:

1. Generate a new key of the same type
2. Update your environment variables
3. Deploy your changes
4. Delete the old key in the dashboard

There is no downtime — old and new keys work simultaneously until you delete the old one.

Allowed Origins

For additional security, you can restrict which domains can use your public key. Go to Settings > API > Allowed Origins and add your storefront domain (e.g., https://mystore.com). Requests from other domains will be rejected.

Rate Limits

API requests are rate-limited per key using a sliding window counter:

When you exceed the limit, the API returns 429 Too Many Requests with these headers:

• Retry-After — seconds until the window resets
• X-RateLimit-Limit — your limit per minute
• X-RateLimit-Remaining — requests remaining in this window
• X-RateLimit-Reset — Unix timestamp when the window resets

Webhooks, superadmin endpoints, and internal paths are exempt from rate limiting.

Next Steps

• Environment Setup — full project configuration
• Common Patterns — error handling, pagination, and conventions
• Rate Limits — detailed rate limiting documentation