Authentication
API keys, signing secrets, OAuth, and Merchant Callback HMAC verification.
Authenticate every outbound request to Bolt with your division's credentials from the Merchant Dashboard.
Key types
| Key | Where to use | How |
|---|---|---|
| API key | Your backend server | X-API-Key header on outbound REST calls |
| Signing secret | Your backend server | Verify X-Bolt-Hmac-Sha256 on inbound webhooks and Merchant Callback requests |
| Publishable key | Storefront / client SDKs | Initialize Bolt Connect, checkout modal, or embeddable components |
Each division has its own keys. Sandbox and production credentials are separate: see Environments.
Outbound API calls
Server-side requests require your API key in the X-API-Key header and Content-Type: application/json for JSON bodies.
Some endpoints also accept X-Nonce: a unique value per request (a UUID works well). Check the endpoint reference if your call fails validation.
const baseUrl: string =
process.env.BOLT_API_BASE_URL ?? "https://api-sandbox.boltapp.com";
const apiKey = process.env.BOLT_API_KEY;
if (!apiKey) throw new Error("Missing BOLT_API_KEY");
const response = await fetch(`${baseUrl}/v1/merchant/orders`, {
method: "POST",
headers: {
"Content-Type": "application/json",
"X-API-Key": apiKey,
},
body: JSON.stringify({ cart }),
});Use your publishable key only in client-side SDK initialization: never in server-side API calls.
Merchant Callback (inbound)
When Bolt calls your server, verify the X-Bolt-Hmac-Sha256 header using your signing secret. See Verify webhooks.
OAuth (shopper accounts)
Third-party apps use the OAuth 2.0 authorization code flow to access Bolt Account data. See Bolt OAuth.
Key rotation
Bolt supports rotating API keys and signing secrets without downtime. See API keys for dashboard steps.