Skip to main content
The Appfox API uses bearer token authentication. Each key is scoped to the Shopify shop that created it.

Generate an API key

  1. Open the Appfox Subscriptions app from your Shopify admin
  2. Navigate to API in the sidebar
  3. Click Generate key
  4. Copy the key immediately — it’s only shown once
The raw key starts with afx_live_ and should be stored in a server-side secret manager. Do not put it in:
  • Browser bundles or mobile apps
  • POS UI extensions
  • Source control
  • Application logs
  • Query parameters or URLs

Key management

  • Each shop can have up to 5 active keys
  • Keys can be revoked immediately from the same API screen
  • Only a SHA-256 digest is stored by Appfox
  • Keys are permanently scoped to the shop that created them
If you downgrade from Enterprise, existing keys are retained but cannot authenticate API operations until you restore the Enterprise plan.

Making authenticated requests

Include your API key as a bearer token in the Authorization header:

Server-to-server only

This API is designed for backend-to-backend communication. If you’re building a POS UI extension or storefront integration, have your client call your own backend, which then calls Appfox with the API key.

Error responses

Authentication errors return 401 Unauthorized:
Plan restriction errors return 403 Forbidden: