API keys
Find and use your API key, signing secret, and publishable key.
Use this guide to copy credentials for the correct environment and publishable key for the intended division, then store each secret in the system that uses it.
Get your keys
- Open the sandbox Merchant Dashboard for testing or the production Merchant Dashboard for live traffic.
- Select the division used by your integration. The selected division determines the publishable key shown under Identifiers.
- Go to Administration > API.
- Copy the credentials your integration needs. Store the API key and signing secret in your backend secret manager, not in client code.
Expected result: Your API key and signing secret come from one environment, and your publishable key identifies the intended division. Do not mix sandbox and production credentials.
Keys
| Key | Purpose | Where it runs |
|---|---|---|
| API key | Authenticate outbound Bolt API calls | Backend server only |
| Signing secret | Verify X-Bolt-Hmac-Sha256 on inbound webhooks and Merchant Callback requests | Backend server only |
| Publishable key | Identify your store to Bolt client SDKs and embed script | Browser or mobile app |
Request headers
- Send your API key in
X-API-Keyon authenticated outbound REST calls. - Send
Content-Type: application/jsonwhen the request has a JSON body. - Add
X-Nonceonly when the endpoint reference requires it.
See Authentication for credential usage and check the endpoint reference before sending a request.
API base URLs
Use the API URL that matches your credentials. Environments lists the sandbox and production API, CDN, and dashboard URLs.
Key rotation
Rotate API keys and signing secrets on a schedule. Bolt supports rotation with no downtime.
Prerequisites
- You can edit developer keys for the merchant account.
- Your webhook verification accepts both active and pending signatures during rotation.
If the rotation controls are not visible, ask your dashboard administrator or Customer Success Manager to confirm your access.
Rotate signing secret
- Go to Administration > API, scroll to Signing Secret, and click Initiate Key Rotation.
- One key is Active and the new key is Pending. Both work during rotation. Validate the old key with
X-Bolt-Hmac-Sha256and the pending key withX-Bolt-Hmac-Sha256-Pending. - After your app accepts the new secret, click Complete Key Rotation to activate the pending key.
Expected result: The new signing secret is Active, and webhook verification succeeds with it.
You can revert to the previous signing secret for up to 48 hours. The signing secret table shows time remaining. Select Revert Key Rotation to roll back.
Rotate API keys
Bolt allows up to five active API keys.
- In Administration > API, select Generate API key.
- Deploy the new key to your backend and confirm authenticated requests succeed.
- Deactivate the old key.
Expected result: Your backend uses the new active key, and the old key no longer authorizes requests.