Superfiliate

Partners API

API Keys

Create, copy, and revoke credentials in Settings → Developers.

Create a key

API keys live in the Superfiliate app, under Settings → Developers. Each key is a client_id / client_secret pair scoped to one store.

  1. 1

    Open Developers

    In the Superfiliate app, go to Settings and open the Developers page. Open the API keys tab.

  2. 2

    Generate API key

    Name the key after the tool that will use it — for example Data warehouse. If the dialog asks you to pick scopes, grant only what that integration needs. You cannot change scopes later: generate another key if the access list has to change.

  3. 3

    Copy the credentials

    The confirmation dialog shows the client ID, the client secret, and the combined API key (client_id:client_secret). Send that combined value as a Bearer token — see Authentication.

What you get

  • client_id starts with sfci1_. It identifies the integration.
  • client_secret starts with sfcs1_. The prefix is there so a leaked secret is easy to find with code search. The same secret signs webhook payloads — see verifying webhook signatures.
  • The combined API key is the two values joined with a colon. That is the Bearer token.

Scopes

Every endpoint requires a scope, listed on its reference page and in the Authentication table. Write access implies read access for the same resource.

Pick the smallest set the integration needs. A 403 means the key is valid but missing a scope — generate a new key with that scope included, then revoke the old one.

Revoke a key

Revoke from the same API keys list. The key stops working immediately, and the action cannot be undone. Confirm by typing REVOKE. Create a replacement key first if the integration still needs access.