Snipcart Authentication: API Keys & Security (2026)

Authentication overview

Snipcart employs API keys as its primary mechanism for authenticating requests to its backend services and API. This system allows developers to programmatically manage various aspects of their e-commerce storefront, including products, orders, customers, and discounts. The use of distinct key types – Public, Secret, and Webhook – ensures appropriate access levels for different operational contexts, from client-side integration to secure server-to-server communication and webhook event processing. Proper management and application of these keys are fundamental to maintaining the security and integrity of a Snipcart-powered e-commerce solution.

Authentication is required for any interaction with the Snipcart API that modifies data or retrieves sensitive information. Client-side operations, such as adding items to a cart or initiating checkout, typically use a Public API key, which is designed to be exposed in the browser. Server-side operations, such as creating products or fetching order details from a backend, necessitate the use of a Secret API key, which must be kept confidential. Webhooks, which allow Snipcart to notify your application of events, are secured using a Webhook API key for signature verification.

Understanding the distinction between these keys and their appropriate use cases is crucial for secure Snipcart integration. Misuse, such as exposing a Secret API key in client-side code, can lead to unauthorized access and potential data breaches. The Snipcart documentation provides detailed guidance on Snipcart authentication methods, emphasizing the importance of secure credential handling.

Supported authentication methods

Snipcart's authentication system is built around three distinct types of API keys, each serving a specific purpose and level of access. These keys facilitate secure interactions with the Snipcart platform, ranging from public-facing storefront operations to secure backend data management.

The primary authentication methods are:

• Public API Key: Used for client-side integration of the Snipcart JavaScript SDK. This key is designed to be publicly exposed in the browser and grants access to non-sensitive operations, such as displaying products, adding items to the cart, and initiating the checkout flow. It identifies your Snipcart account and allows the Snipcart.js library to function correctly on your website.
• Secret API Key: Employed for server-side API requests that require access to sensitive data or the ability to modify account settings, products, orders, and customer information. This key must be kept confidential and is never to be exposed in client-side code or public repositories. It grants full administrative control over your Snipcart account via the API.
• Webhook API Key: Used to secure webhooks by verifying the authenticity of incoming requests from Snipcart. When Snipcart sends a webhook event to your application, it includes an HMAC signature generated using this key. Your application can then use its copy of the Webhook API key to re-generate the signature and compare it, ensuring the request genuinely originated from Snipcart and has not been tampered with. This method is critical for maintaining the integrity of event-driven integrations.

The table below summarizes Snipcart's supported authentication methods:

Getting your credentials

Accessing your Snipcart API keys requires logging into your Snipcart dashboard. Each key type (Public, Secret, Webhook) is generated and managed within specific sections of your account settings.

1. Log in to your Snipcart Dashboard: Navigate to the Snipcart dashboard using your registered account credentials.
2. Access API Keys Section: Once logged in, go to 'Account Settings' (often found under your profile icon or a dedicated 'Settings' menu item). Look for a section explicitly labeled 'API Keys' or similar.
3. Retrieve Public API Key: Your Public API key is typically displayed prominently within the API Keys section. It's designed for client-side use and can be copied directly.
4. Generate/Retrieve Secret API Key: Secret API keys are usually hidden by default for security reasons. You might need to click a 'Reveal' or 'Generate new Secret key' button. Treat this key with extreme care. If you suspect it has been compromised, you should revoke it and generate a new one immediately.
5. Generate/Retrieve Webhook API Key: Within the same 'API Keys' or 'Webhooks' settings, you will find options to generate or retrieve your Webhook API key. This key is used in conjunction with your webhook endpoints for signature verification.

It's important to note that Snipcart allows you to generate multiple API keys for different environments (e.g., development, staging, production) or for different applications interacting with your account. This practice enhances security by limiting the scope of a single key and facilitating easier revocation without impacting all integrations. Always refer to the Snipcart API authentication guide for the most current instructions on credential management.

Authenticated request example

When making server-side API requests to Snipcart, you must include your Secret API key in the Authorization header using the Bearer token scheme. The Snipcart API expects the key to be prefixed with Bearer, followed by a space, and then the key itself. For client-side interactions, the Public API key is included directly in the Snipcart.js script tag.

Server-side API Request (using Secret API Key)

This example demonstrates how to fetch a list of orders using a Secret API key. This type of request would typically be made from a backend server where the Secret API key can be securely stored.

curl -X GET \
  'https://app.snipcart.com/api/orders' \
  -H 'Accept: application/json' \
  -H 'Authorization: Bearer YOUR_SECRET_API_KEY'

Replace YOUR_SECRET_API_KEY with your actual Secret API key obtained from your Snipcart dashboard.

Client-side Snipcart.js Initialization (using Public API Key)

This example shows how to initialize Snipcart on a webpage using your Public API key. This script should be placed in the <head> or just before the closing </body> tag of your HTML document.

<script src="https://cdn.snipcart.com/themes/v3.0.31/default/snipcart.js"></script>
<div id="snipcart" data-api-key="YOUR_PUBLIC_API_KEY" data-config-add-product-behavior="none" hidden></div>

Replace YOUR_PUBLIC_API_KEY with your actual Public API key. The data-config-add-product-behavior="none" is an example of a configuration option, which can be adjusted based on your needs.

Webhook Signature Verification (using Webhook API Key)

To verify a webhook, your application receives an HTTP POST request from Snipcart. The request includes a Snipcart-Signature header. You should calculate an HMAC SHA256 signature of the request body using your Webhook API key and compare it to the signature provided in the header. The Twilio webhook security guide provides a general overview of webhook signature verification principles, which are applicable to Snipcart's approach.

const crypto = require('crypto');

function verifySnipcartWebhook(requestBody, signatureHeader, webhookApiKey) {
  const expectedSignature = crypto
    .createHmac('sha256', webhookApiKey)
    .update(requestBody)
    .digest('base64');

  return expectedSignature === signatureHeader;
}

// Example usage in an Express.js route handler:
// app.post('/snipcart-webhook', (req, res) => {
//   const signature = req.headers['snipcart-signature'];
//   const isValid = verifySnipcartWebhook(JSON.stringify(req.body), signature, process.env.SNIPCART_WEBHOOK_SECRET);
//
//   if (isValid) {
//     // Process the webhook event
//     res.status(200).send('Webhook received and verified');
//   } else {
//     res.status(401).send('Unauthorized webhook');
//   }
// });

This JavaScript example illustrates the logic for verifying a webhook. Ensure requestBody is the raw request body string and signatureHeader is the value from the Snipcart-Signature header.

Security best practices

Implementing strong security practices when working with Snipcart API keys is essential to protect your e-commerce data and prevent unauthorized access. Adhering to these guidelines helps maintain the integrity and confidentiality of your Snipcart integration.

• Never expose Secret API keys client-side: Secret API keys grant full administrative control. They must only be used on your backend servers or in secure environments where they cannot be accessed by the public. Exposing them in browser-side JavaScript or public repositories is a critical security vulnerability.
• Store Secret and Webhook API keys securely: Use environment variables or secure configuration management systems to store your Secret and Webhook API keys. Avoid hardcoding them directly into your application's source code. For cloud deployments, leverage secret management services provided by your cloud provider (e.g., AWS Secrets Manager, Google Cloud Secret Manager, Azure Key Vault).
• Implement Webhook Signature Verification: Always verify the Snipcart-Signature header for incoming webhooks. This ensures that the request originated from Snipcart and has not been altered in transit. Failing to verify signatures can leave your application vulnerable to spoofed events.
• Use HTTPS for all communications: Ensure all interactions with the Snipcart API, including your own webhooks and client-side scripts, are conducted over HTTPS. This encrypts data in transit, protecting sensitive information from eavesdropping and tampering.
• Regularly rotate API keys: Periodically generate new Secret and Webhook API keys and update your applications. This practice minimizes the risk associated with a compromised key, as the lifecycle of any single key is limited. If a key is suspected of being compromised, revoke it immediately and generate a new one.
• Grant least privilege: While Snipcart API keys generally offer broad access, if your application design allows for it, consider creating separate Snipcart accounts or integrations for different functionalities to limit the blast radius of a compromised key.
• Monitor API key usage: Keep an eye on your Snipcart dashboard for any unusual activity or spikes in API usage that might indicate unauthorized access.
• Review and audit code: Regularly review your application's code for any accidental exposure of API keys or insecure practices. Consider automated security scanning tools as part of your development workflow.
• Secure your development environment: Ensure that your development, staging, and production environments all follow strong security practices, especially regarding the storage and access of API keys.

By following these best practices, developers can significantly enhance the security posture of their Snipcart integrations, safeguarding customer data and maintaining the reliability of their e-commerce operations. The Snipcart documentation provides additional security recommendations for Snipcart integrations.