Which credential should a server use?

Send the store's sid and secret as HTTP Basic credentials (Authorization: Basic base64(sid:secret)). This carries the full privileges of the store, so keep it server-side only.

Which credential is safe to ship in browser code?

The public (unauth) token, sent as X-PrintCart-Unauth-Token. It is deliberately low-privilege but still accepted on a few write endpoints the customizer needs, such as saving a design.

How do I rotate a leaked credential?

Call PUT /stores/token-revoke. It reissues the sid, secret and public token together with no overlap window, so plan your front-end deploy for the same moment.

Can you work with a merchant in my country?

Yes. Printcart services are delivered remotely, so we work with merchants in any country. Netbase JSC, the company behind Printcart, has worked with clients in 80+ countries.

Do you support my industry?

Printcart services are not tied to one industry. Full stores, custom development, integration and support are delivered remotely; tell us what you sell and we will say plainly whether Printcart fits.

How do I pay securely?

You sign the contract with and pay the company, Netbase JSC. App plans are billed through Shopify or Wix for stores on those platforms, and through PayPal for WooCommerce and direct stores. Full-store orders on solution.printcart.com check out through PayPal. Service work is quoted in writing in your Helpdesk ticket before any payment.

Talk to our CEO, Huy Nguyen (David), on WhatsApp at https://wa.me/84937869689 or by email at support@printcart.com.

Authentication

Printcart's REST API accepts four credential types: a server-side store key, a low-privilege public token for browsers, an account JWT paired with a store, and an account-only JWT. Each endpoint's security block in the API Reference lists which ones it accepts. This page explains which credential to send from a server or browser, and how to rotate one that leaks.

Updated 10 Nov 2026. Maintained by the Printcart team.

Credential types

Several credentials coexist. Each endpoint in the API reference lists the ones it accepts in its security block.

Credential	How it is sent	Resolves to	Use it from
Store key	`Authorization: Basic base64(sid:secret)`	a Store	your server
Public (unauth) token	`X-PrintCart-Unauth-Token: <token>`	a Store	a browser or the customizer
Account JWT with store	`Authorization: Bearer <jwt>` plus `X-PrintCart-Store-Sid: <sid>`	a Store	a dashboard acting on one store
Account JWT	`Authorization: Bearer <jwt>`	a User	account-level calls only

The secret is a server-side credential and must never reach a browser. The public token is the only credential intended for public clients. It is deliberately low-privilege, but it is accepted on a few write endpoints (saving a design, creating a project, uploading an image) because the customizer needs them.

Where an endpoint lists the public token, the store key and the JWT are accepted too. The reverse is not true: an endpoint that lists only the store key rejects the public token.

Store key (server side)

Send the store sid and secret as HTTP Basic credentials. This represents the full privileges of the store, so use it only from your own server.

bash

curl https://api.printcart.com/v1/products -u "$SID:$SECRET"

Never publish the sid and secret in a repository, client-side code or a public support thread.

Public token (browser)

Endpoints that only expose public data accept the store's unauth token in the X-PrintCart-Unauth-Token header. It can be shipped in storefront code.

http

X-PrintCart-Unauth-Token: <unauth token>

You can copy the token from the Settings page of your Printcart dashboard.

Account JWT

POST /account/signIn returns a JWT for an account. Four account-level endpoints accept only a JWT: GET /stores, POST /stores, PUT /account and PUT /account/password-update. If you hold a store's sid:secret, GET /account/render-jwt mints a JWT for the owner, so a server can reach those endpoints without scripting a human login.

Reading credentials back

sid, secret and unauth_token are returned only when you ask for them: add ?include=credentials to a store read. A call authenticated with the public token never receives them.

Rotating credentials

PUT /stores/token-revoke reissues the sid, the secret and the public token together. There is no overlap window: as soon as it returns, the old store key and the old public token stop working, including a token compiled into a storefront bundle you have already shipped. Plan the front-end deploy for the same moment. Rotating only the secret is not supported.

Developer API keys

Developer API keys (sk_ and pk_) are created with POST /stores/{store}/api-keys and POST /account/api-keys. They require the Advanced plan or above. Below that, the endpoints answer 402 with error.code set to capability_not_available and an upgrade link in error.details.cta.url.

AI and Studio services

The pay-per-token AI Services and Studio AI endpoints use account-level JWT authentication and bill the account's token wallet.

Questions & answers

Which credential should a server use?: Send the store's sid and secret as HTTP Basic credentials (Authorization: Basic base64(sid:secret)). This carries the full privileges of the store, so keep it server-side only.
Which credential is safe to ship in browser code?: The public (unauth) token, sent as X-PrintCart-Unauth-Token. It is deliberately low-privilege but still accepted on a few write endpoints the customizer needs, such as saving a design.
How do I rotate a leaked credential?: Call PUT /stores/token-revoke. It reissues the sid, secret and public token together with no overlap window, so plan your front-end deploy for the same moment.
Can you work with a merchant in my country?: Yes. Printcart services are delivered remotely, so we work with merchants in any country. Netbase JSC, the company behind Printcart, has worked with clients in 80+ countries.
Do you support my industry?: Printcart services are not tied to one industry. Full stores, custom development, integration and support are delivered remotely; tell us what you sell and we will say plainly whether Printcart fits.
How do I pay securely?: You sign the contract with and pay the company, Netbase JSC. App plans are billed through Shopify or Wix for stores on those platforms, and through PayPal for WooCommerce and direct stores. Full-store orders on solution.printcart.com check out through PayPal. Service work is quoted in writing in your Helpdesk ticket before any payment.
Who do I talk to?: Talk to our CEO, Huy Nguyen (David), on WhatsApp at https://wa.me/84937869689 or by email at support@printcart.com.