Keys and Permissions PRO
Every request carries a key that says which store it is for and what it may do.
Create a key
In the panel, open Store settings → API and click New key. Only the store owner can create keys.
Give it a name you'll recognize later, like My card game.
Choose what the key can do. A new key can only read. Add only what this project needs: you can change it later without replacing the key.
Copy the key now. It starts with
fsk_and is shown only once. Lost it? Revoke it and create another.
A store can have up to 5 active keys. For each one, the panel shows its last 4 characters, what it can do, when it was last used and how many requests it made today.
Send the key
Put it in the Authorization header of every request:
Authorization: Bearer fsk_…To check a key, call GET /me: it answers with the store, the permissions and today's usage.
What a key can do
Each area can be View or View and change. "View and change" includes "View".
| In the panel | Scope | What it opens |
|---|---|---|
| Products and groups | products:read · products:write | Products, groups, prices, stock, pausing |
| Sales | sales:read | Sales, with the same details webhooks send |
| Customers and purchases | customers:read | Customers and did this avatar buy it? |
| Deliveries | deliveries:write | Send a product, redeliver a sale |
| Points | points:read · points:write | Balance, history, give or take points |
| Gift cards | gift_cards:read · gift_cards:write | List, give, adjust and cancel |
| Coupons | coupons:read · coupons:write | List, create and change |
| Promotions | discounts:read · discounts:write | List, create and end |
| Vendors and hubs | vendors:read · vendors:write | List them, change what a vendor sells |
| Reports | reports:read | The sales summary |
Each route in the reference shows the scope it needs. A key without it gets 403 MISSING_SCOPE, and the message names the scope:
{
"error": {
"code": "MISSING_SCOPE",
"message": "This key does not have the products:write scope. The store owner can add it in Settings → API.",
"request_id": "req_tj71gk45m4cs98"
}
}One key per project
Give each game or site its own key, with only what it needs. If one leaks, you revoke that key and everything else keeps working.
Keep the key secret
Anyone holding a key can do what it allows.
| Where your code runs | Where the key goes |
|---|---|
| Your server or bot | In an environment variable, never in the code or in a Git repository. |
| Second Life | In a script set to no-copy and no-modify, in an object only you own. Never in a notecard or in an object description. |
| A web page | Nowhere. The API refuses requests from browsers on purpose, because anyone could read the key in the page source. Call it from your server instead. |
Selling an object that uses the API? Don't put your key inside it. Run a small server of your own, or let the object ask a script of yours that stays in your store.
Think a key leaked? Revoke it in Store settings → API. It stops working right away. Then create a new one.
When Pro ends
| Your store | The API |
|---|---|
| Pro | Everything the key allows. |
| Pro expired | Reading keeps working, so scripts that check purchases in your games don't break. Changes answer 403 PRO_REQUIRED until you renew. You can still revoke keys. |
| Basic | No keys. |
| Suspended | Reading only. Changes answer 403 STORE_SUSPENDED. |
GET /me tells you where you stand: access is full or read_only.