Authentication
Which credential to send, from a server and from a browser, and how to rotate them.
Credential types
Several credentials coexist. Each endpoint in the API reference lists the ones it accepts in its security block.
| Credential | How it is sent | Resolves to | Use it from |
|---|---|---|---|
| Store key | Authorization: Basic base64(sid:secret) | a Store | your server |
| Public (unauth) token | X-PrintCart-Unauth-Token: <token> | a Store | a browser or the customizer |
| Account JWT with store | Authorization: Bearer <jwt> plus X-PrintCart-Store-Sid: <sid> | a Store | a dashboard acting on one store |
| Account JWT | Authorization: Bearer <jwt> | a User | account-level calls only |
The secret is a server-side credential and must never reach a browser. The public token is the only credential intended for public clients. It is deliberately low-privilege, but it is accepted on a few write endpoints (saving a design, creating a project, uploading an image) because the customizer needs them.
Where an endpoint lists the public token, the store key and the JWT are accepted too. The reverse is not true: an endpoint that lists only the store key rejects the public token.
Store key (server side)
Send the store sid and secret as HTTP Basic credentials. This represents the full privileges of the store, so use it only from your own server.
curl https://api.printcart.com/v1/products -u "$SID:$SECRET"Never publish the sid and secret in a repository, client-side code or a public support thread.
Public token (browser)
Endpoints that only expose public data accept the store's unauth token in the X-PrintCart-Unauth-Token header. It can be shipped in storefront code.
X-PrintCart-Unauth-Token: <unauth token>You can copy the token from the Settings page of your Printcart dashboard.
Account JWT
POST /account/signIn returns a JWT for an account. Four account-level endpoints accept only a JWT: GET /stores, POST /stores, PUT /account and PUT /account/password-update. If you hold a store's sid:secret, GET /account/render-jwt mints a JWT for the owner, so a server can reach those endpoints without scripting a human login.
Reading credentials back
sid, secret and unauth_token are returned only when you ask for them: add ?include=credentials to a store read. A call authenticated with the public token never receives them.
Rotating credentials
PUT /stores/token-revoke reissues the sid, the secret and the public token together. There is no overlap window: as soon as it returns, the old store key and the old public token stop working, including a token compiled into a storefront bundle you have already shipped. Plan the front-end deploy for the same moment. Rotating only the secret is not supported.
Developer API keys
Developer API keys (sk_ and pk_) are created with POST /stores/{store}/api-keys and POST /account/api-keys. They require the Advanced plan or above. Below that, the endpoints answer 402 with error.code set to capability_not_available and an upgrade link in error.details.cta.url.
AI and Studio services
The pay-per-token AI Services and Studio AI endpoints use account-level JWT authentication and bill the account's token wallet.