Quickstart

Create a scoped API key, make your first request, and receive a signed webhook, in about five minutes.

1. Create an API key

In the dashboard, open Settings → Developers → API keys and choose Create API key. Give it only what your integration needs: for this quickstart, Catalog: read and Orders: read. The secret (sk_live_…, or sk_test_… on a development server) is shown once. Store it in your server’s environment, never in a browser.

The key already belongs to your store, so requests need no store id: store endpoints start at /v1/store.

2. Call the API

curl https://api.shopfa.st/v1/store/products?limit=5 \
  -H "Authorization: Bearer $SHOPFAST_API_KEY"

const res = await fetch('https://api.shopfa.st/v1/store/products?limit=5', {
  headers: { Authorization: `Bearer ${process.env.SHOPFAST_API_KEY}` },
});
if (!res.ok) throw new Error((await res.json()).detail);
const { items, nextCursor } = await res.json();

import os, requests

res = requests.get(
    "https://api.shopfa.st/v1/store/products",
    params={"limit": 5},
    headers={"Authorization": f"Bearer {os.environ['SHOPFAST_API_KEY']}"},
)
res.raise_for_status()
products = res.json()["items"]

Prefer to name the store? Every endpoint also works as /v1/stores/st_…/products (the store id is under Settings → Developers → API & CLI); a key still reaches only its own store.

Every list answers { items, nextCursor }. Pass nextCursor back as cursor for the next page (Pagination).

3. Receive a webhook

Open Settings → Developers → Webhooks, add your HTTPS endpoint and subscribe it to order.paid. Then choose Send test event. Your server receives a POST like this:

POST /shopfast HTTP/1.1
content-type: application/json
webhook-id: msg_9c2k4m7q1x0v8b3n6h5d
webhook-timestamp: 1792540800
webhook-signature: v1,K5oZfzN95Z9UVu1EsfQmfVNQhnkZ2pj9o9NDN/H/pI4=
x-shopfast-event: order.paid

{"id":"msg_9c2k4m7q1x0v8b3n6h5d","type":"order.paid","createdAt":"2026-10-21T12:00:00.000Z","storeId":"st_…","data":{"order":{…}}}

Verify the signature before you trust it. The webhooks guide has verifiers in TypeScript, Python, Go and PHP.

4. Try it locally

The shopfast CLI forwards live events to localhost, signed exactly like production:

bun shopfast.js login --store st_… --key sk_test_…
bun shopfast.js listen --forward-to http://localhost:3000/shopfast

Next

• Authentication: scopes, test keys, IP allowlists.
• API reference: every endpoint, with a try-it console.
• Lua plugins: add a payment method or a delivery without running a server.