API keys let another system read your membership data and, if you allow it, change it. You use them to connect Zapier, your own tools or an app your developer built. You create, view and revoke keys on the API Access page in Appstle Memberships. This article is for store owners, and for the developers and agencies who set up integrations for them.
Availability: API access is included in the Enterprise and Enterprise Plus plans. On other plans, you can add it for $50/month (see our plans). Without it you can still create keys, but the Appstle Memberships API rejects requests made with them. The banner on the API Access page shows whether your store has it.
Before you start
Make sure API access is enabled for your store. The banner above the API Keys card tells you (see the next section).
Sign in as the store owner, as a staff member with full access to your Shopify admin, or as a staff member the owner has authorized. Other staff see a message instead of the keys (see the FAQs).
Decide what the integration needs to do. A key that only reads data is safer than one that can also change it.
Check that API access is enabled
In your Shopify admin, open Apps → Appstle℠ Memberships.
Click More, then under General Settings click API Access.
Read the banner above the API Keys card. If it says API access is enabled for your store, as in the image below, your keys work.
If the banner says API access isn’t enabled for your store, you can still create and view keys, but requests made with them, including the legacy key, are rejected. To have API access switched on, click Chat with us in the banner or in the Guide for API Access card. A Partner: Appstle Loyalty key, if you have one, keeps working.
At the top of the page, the Guide for API Access card links to the developer documentation at developers.appstle.com, where your developer finds every endpoint.
Create an API key
On the API Access page, in the API Keys card, click Create API key.
In Key name, type a name that tells you what the key is for, such as Reporting dashboard. The name can be up to 100 characters.
Under Permission, keep Read & Write, which is selected by default, or choose Read only, as in the first image below. The table after the images explains the difference.
Click Create.
In the Your new API key window, click Copy and paste the key into your password manager or straight into the integration, as in the second image below.
Select I have saved this API key, then click Done. The Done button stays gray until you select the checkbox.
Important: Copy the key as soon as you create it. The full key is shown only once and can’t be shown again. If you close the window without saving it, create a new key.
Both permissions can read your membership data. They differ in what else the key can do:
Permission | What the key can do |
Read & Write | Read data, and also create, change and delete it. |
Read only | Read data only. Anything that would change data fails with a 403 error: “This API key is read-only and cannot perform write operations.” |
A few requests look like reads but delete plans, send an email or hand out a customer sign-in or payment link. They need a Read & Write key too, and a Read only key gets the same 403 error on them.
Manage your keys
The API Keys card lists every key for your store, newest first, including revoked ones. Each row shows the key name, a status (Active or Revoked), its permission, the first characters of the key, the date you created it and, once it has been used, the date it was last used. Use the Last used date to spot keys nobody needs anymore.
If you connected Appstle Loyalty to Appstle Memberships, the list also shows a key named Partner: Appstle Loyalty. Appstle Loyalty created it to read and update your memberships. It counts toward the 10-key limit and works whether or not API access is enabled for your store. Don’t revoke it unless you want Appstle Loyalty to stop working with your memberships.
Revoke a key
In the key’s row, click Revoke.
Check the key name in the window that opens, then click Revoke key.
Any integration that uses a revoked key stops working at once, and you can’t undo it. To replace a key without a gap, create the new key first, update the integration to use it, then revoke the old one.
The legacy API key
If your store had an API key before keys were managed on this page, it appears in a separate Legacy API Key card under the list, with only its last four characters showing. The Active badge means it hasn’t been revoked. Like any other key, it can call the Appstle Memberships API only while API access is enabled for your store. Unlike a new key, it always has full read and write access.
We recommend creating new keys, moving your integrations to them, and then revoking the legacy key. To revoke it, click Revoke in the card, then click Revoke key. You don’t get a new legacy key, and you can’t undo it.
Use the key in your integration
Your developer sends the key in the X-API-Key header of every request. For the endpoints, request examples and the 401 and 403 errors, see the developer guide Authenticate with the Appstle Memberships API.
Connect Zapier
When you connect Appstle Memberships in Zapier, Zapier asks for your API key. Create a key with Read & Write permission for it. With a Read only key, Zapier connects but your Zaps can’t be turned on, because Zapier needs write access to set up its triggers. For the full setup, see Zapier Integration - Memberships.
Things to know
You can have up to 10 active keys at a time, including a Partner: Appstle Loyalty key. Revoked keys and the legacy key don’t count. At 10, the card shows “Maximum of 10 active API keys reached. Revoke an existing key to create a new one.”
The full key is shown once, when you create it. After that, the list shows only its first characters.
Keys belong to your store only. A key from one store can’t read another store’s data.
Give each integration its own key. You can then revoke one without breaking the others.
FAQs
The API Access page says my user ID isn’t authorized
Only the store owner, staff with full access to your Shopify admin, and staff the owner has authorized can see the keys. Everyone else sees their user ID and a message instead. To authorize you, the store owner:
Opens More → General Settings → Shop Settings.
In Account Ownership Settings, turns on Authorize All Staff Members or adds your user ID to Allow Export To Escalated User IDs.
Clicks Save.
Both options also let those staff export member data.
My integration gets an error with a valid key
Check these in order:
API access: if the banner says API access isn’t enabled for your store, requests fail with “You do not have permission to access the External API.” Click Chat with us in the banner.
Key status: a revoked key fails with “This API key has been revoked.” Create a new key.
Permission: on any request that changes data, a Read only key fails with “This API key is read-only and cannot perform write operations.” Use a Read & Write key.
Header: the key must be sent in the X-API-Key header. A mistyped key fails with “Invalid API key.”
Zapier connects, but I can’t turn on my Zap
Your key is probably Read only. Zapier needs a Read & Write key to set up its triggers. Create a Read & Write key, reconnect your Appstle Memberships account in Zapier with it, then revoke the old key.
I lost my API key. Can I see it again?
No. The full key is shown only when you create it. Create a new key, update your integration, then revoke the lost one.
Can I change a key’s name or permission?
No. Create a new key with the name and permission you want, move your integration to it, then revoke the old key.
How do I send membership events to my own system without polling the API?
Use webhooks. See Send membership events to your own systems with webhooks.
Need help? Email [email protected] and tell us your store address.