# Your first API call

> A key, one request, real data. Five minutes.

Source: https://docs.dashfordevs.com/v1/getting-started/first-api-call · Topic: Quickstart · Updated: 2026-11-07

## 1\. Get a key

In the dashboard, open **Developers → API keys**. Every organization has:

-   a **public key** (`pk_…`): read-only, safe in browser code;
-   a **secret key** (`sk_…`): can change data, server-side only.

Use a **test** public key for now: test keys work from any origin, including localhost and curl. Live public keys only answer from the [allowed origins](https://docs.dashfordevs.com/v1/authentication/allowed-origins) you list.

## 2\. Call the API

```bash
curl "https://papi.dashfordevs.com/api/storefront/products?limit=3" \
  -H "X-API-Key: pk_test_YOUR_PUBLIC_KEY"
```

You get JSON back. Useful query parameters: `limit` (up to 100), `page`, `category`, `search`, `in_stock=true`, `sort=price_asc|price_desc|rating`.

```json
{
  "products": [
    { "id": "…", "name": "Lemon Loaf", "slug": "lemon-loaf", "…": "…" }
  ],
  "pagination": { "total": 42, "limit": 3, "offset": 0, "page": 1, "has_more": true }
}
```

## 3\. Read the headers

```http
X-RateLimit-Limit: 120
X-RateLimit-Remaining: 119
X-RateLimit-Reset: 1762531260
Cache-Control: private, no-store, max-age=0, must-revalidate
```

A public key can make 120 requests a minute, a secret key 300. See [Errors and rate limits](https://docs.dashfordevs.com/v1/error-handling).

## What just happened

```dfd-diagram
{
  "type": "sequence",
  "title": "One storefront request",
  "actors": [
    { "id": "you", "label": "curl" },
    { "id": "papi", "label": "papi.dashfordevs.com" },
    { "id": "tapi", "label": "tapi (private)" },
    { "id": "inv", "label": "inventory service" }
  ],
  "messages": [
    { "from": "you", "to": "papi", "label": "GET /api/storefront/products  X-API-Key" },
    { "from": "papi", "to": "papi", "label": "check key, origin, rate limit, organization" },
    { "from": "papi", "to": "tapi", "label": "forward + signed identity (no key)" },
    { "from": "tapi", "to": "inv", "label": "/inventory/v1/papi/storefront/products" },
    { "from": "inv", "to": "you", "label": "200 JSON", "reply": true }
  ],
  "steps": [
    { "title": "You send the key", "focus": [0], "text": "Only papi ever sees your API key." },
    { "title": "papi checks it", "focus": [1], "text": "Is the key real and active? Is the origin allowed? Is the organization active? Under the rate limit?" },
    { "title": "papi forwards a signed identity", "focus": [2, 3], "text": "The service receives a short-lived, signed statement of which organization is asking. Never the key." },
    { "title": "The service answers", "focus": [4], "text": "inventory reads your organization's products and replies. papi passes the JSON through unchanged." }
  ]
}
```

Next: [Build a storefront page with the SDK](https://docs.dashfordevs.com/v1/getting-started/storefront-with-the-sdk).