Authentication

Every request to the Shootika API carries an API key. A key belongs to one store, and whatever it does happens in that store.

Who can use the API

The API is for web app stores, the ones that use Shootika at panel.shootika.com. API keys are created there.

A store that uses Shootika only through the Shopify app has no API key screen. To drive a Shopify store from outside Shopify, connect an AI assistant instead.

Create a key

You need to be an admin of the store in the web app.

1. In the web app, open Settings, then API Keys.
2. Choose Create key and give the key a name you will recognize later, such as the system that will use it.
3. Copy the key. It starts with shootika_sk_ and is shown only once. Store it in your secret manager or environment, never in code you commit.

A member who is not an admin sees the keys but cannot create one.

Send the key

Send the key in the Authorization header of every request, as a Bearer token:

curl https://api.shootika.com/v1/account \
  -H "Authorization: Bearer $SHOOTIKA_API_KEY"

GET /v1/account is a good first call: it names the store the key belongs to and shows how many frames are left. The base URL of every endpoint is https://api.shootika.com/v1.

A request without the header, or with a key that is not valid or has been revoked, answers 401 with the code unauthorized.

When your frames run out

On a web app store, shoots stop when your plan’s frames are used up: POST /v1/frames answers 402 with the code quota_exceeded. Check account.quota.available with GET /v1/account before a batch. What each plan includes is on shootika.com/pricing.

Each key also has an Extra frames switch in the key list, shown in GET /v1/account as account.key.allow_overage. It lets a key shoot past the allowance on a plan that bills extra frames, which only monthly Shopify plans do, so it has no effect on a web app store.

Revoke a key

An admin revokes the key in Settings, API Keys: choose Revoke on it. Other members do not see that button. Anything using the key stops working at once, and every request with it answers 401 unauthorized. Revoking cannot be undone; create a new key instead.

When a store uninstalls Shootika, its keys stop working too, and every request with one answers 403 store_uninstalled.