Authentication

Authenticate every outbound request to Bolt with your division’s credentials from the Merchant Dashboard.

Key types

Key	Where to use	How
API key	Your backend server	`X-API-Key` header on outbound REST calls
Signing secret	Your backend server	Verify `X-Bolt-Hmac-Sha256` on inbound webhooks and Merchant Callback requests
Publishable key	Storefront / client SDKs	Initialize Bolt Connect, checkout modal, or embeddable components

Each division has its own keys. Sandbox and production credentials are separate: see Environments.

Outbound API calls

Server-side requests require your API key in the X-API-Key header and Content-Type: application/json for JSON bodies. Some endpoints also accept X-Nonce: a unique value per request (a UUID works well). Check the endpoint reference if your call fails validation.

cURL

curl -X POST 'https://api-sandbox.bolt.com/v1/merchant/orders' \
  -H 'Content-Type: application/json' \
  -H 'X-API-Key: YOUR_API_KEY' \
  -d '{"cart": {...}}'

const baseUrl = process.env.BOLT_API_BASE_URL ?? "https://api-sandbox.bolt.com";

const response = await fetch(`${baseUrl}/v1/merchant/orders`, {
  method: "POST",
  headers: {
    "Content-Type": "application/json",
    "X-API-Key": process.env.BOLT_API_KEY,
  },
  body: JSON.stringify({ cart }),
});

import os
import requests

base_url = os.environ.get("BOLT_API_BASE_URL", "https://api-sandbox.bolt.com")

requests.post(
    f"{base_url}/v1/merchant/orders",
    headers={
        "Content-Type": "application/json",
        "X-API-Key": os.environ["BOLT_API_KEY"],
    },
    json={"cart": cart},
)

Use your publishable key only in client-side SDK initialization: never in server-side API calls.

Merchant Callback (inbound)

When Bolt calls your server, verify the X-Bolt-Hmac-Sha256 header using your signing secret. See Verify webhooks.

OAuth (shopper accounts)

Third-party apps use the OAuth 2.0 authorization code flow to access Bolt Account data. See Bolt OAuth.

Key rotation

Bolt supports rotating API keys and signing secrets without downtime. See API keys for dashboard steps.

Introduction

Merchant Callback

Endpoints

Key types

Outbound API calls

Merchant Callback (inbound)

OAuth (shopper accounts)

Key rotation

​Key types

​Outbound API calls

​Merchant Callback (inbound)

​OAuth (shopper accounts)

​Key rotation

​Related

Key types

Outbound API calls

Merchant Callback (inbound)

OAuth (shopper accounts)

Key rotation

Related