Use the Bolt API to create orders, authorize payments, manage shopper accounts, and receive webhooks. Your server makes outbound REST calls to Bolt; Bolt makes inbound callbacks to your server for cart, shipping, and tax.

Prerequisites

Get credentials

Copy these values from Administration → API in your dashboard: Sandbox and production each have separate keys. See API keys for dashboard screenshots and key rotation.

Configure your environment

Store credentials in environment variables. Never commit keys to source control.
For production, set BOLT_ENV=production and BOLT_API_BASE_URL=https://api.bolt.com with production keys.
.env
Never use sandbox keys against api.bolt.com or production keys against api-sandbox.bolt.com. Mismatched credentials return 401 errors.
See Environments for CDN URLs, divisions, and approved domains.

Make your first request

List recent transactions in sandbox to confirm your API key and base URL are correct.
cURL
Expected result: HTTP 200 with a JSON response. If you receive 401, confirm you are using the API key (not the publishable key) and the matching sandbox base URL. See Authentication for inbound HMAC verification, OAuth, and required headers.

How the docs are organized

Response codes

See Errors for Bolt-specific error codes.