# Quickstart

> Create a scoped API key, make your first request, and receive a signed webhook, in about five minutes.

Source: https://shopfa.st/docs/quickstart

## 1. Create an API key

In the dashboard, open **Settings → Developers → API keys** and choose **Create API key**. Give it only what your
integration needs: for this quickstart, **Catalog: read** and **Orders: read**. The secret (`sk_live_…`, or
`sk_test_…` on a development server) is shown once. Store it in your server's environment, never in a browser.

The key already belongs to your store, so requests need no store id: store endpoints start at `/v1/store`.

## 2. Call the API

<div class="tabs">

```sh
curl https://api.shopfa.st/v1/store/products?limit=5 \
  -H "Authorization: Bearer $SHOPFAST_API_KEY"
```

```ts
const res = await fetch('https://api.shopfa.st/v1/store/products?limit=5', {
  headers: { Authorization: `Bearer ${process.env.SHOPFAST_API_KEY}` },
});
if (!res.ok) throw new Error((await res.json()).detail);
const { items, nextCursor } = await res.json();
```

```python
import os, requests

res = requests.get(
    "https://api.shopfa.st/v1/store/products",
    params={"limit": 5},
    headers={"Authorization": f"Bearer {os.environ['SHOPFAST_API_KEY']}"},
)
res.raise_for_status()
products = res.json()["items"]
```

</div>

Prefer to name the store? Every endpoint also works as `/v1/stores/st_…/products` (the store id is under
**Settings → Developers → API & CLI**); a key still reaches only its own store.

Every list answers `{ items, nextCursor }`. Pass `nextCursor` back as `cursor` for the next page
([Pagination](https://shopfa.st/docs/guides/pagination)).

## 3. Receive a webhook

Open **Settings → Developers → Webhooks**, add your HTTPS endpoint and subscribe it to `order.paid`. Then choose
**Send test event**. Your server receives a POST like this:

```http
POST /shopfast HTTP/1.1
content-type: application/json
webhook-id: msg_9c2k4m7q1x0v8b3n6h5d
webhook-timestamp: 1792540800
webhook-signature: v1,K5oZfzN95Z9UVu1EsfQmfVNQhnkZ2pj9o9NDN/H/pI4=
x-shopfast-event: order.paid

{"id":"msg_9c2k4m7q1x0v8b3n6h5d","type":"order.paid","createdAt":"2026-10-21T12:00:00.000Z","storeId":"st_…","data":{"order":{…}}}
```

Verify the signature before you trust it. The [webhooks guide](https://shopfa.st/docs/guides/webhooks#verify-the-signature) has
verifiers in TypeScript, Python, Go and PHP.

## 4. Try it locally

The [shopfast CLI](https://shopfa.st/docs/cli) forwards live events to `localhost`, signed exactly like production:

```sh
bun shopfast.js login --store st_… --key sk_test_…
bun shopfast.js listen --forward-to http://localhost:3000/shopfast
```

## Next

- [Authentication](https://shopfa.st/docs/guides/authentication): scopes, test keys, IP allowlists.
- [API reference](https://shopfa.st/docs/api): every endpoint, with a try-it console.
- [Lua plugins](https://shopfa.st/docs/plugins): add a payment method or a delivery without running a server.