Skip to content

Developers & API keys

Creating keys, scopes, test mode, webhooks — the screen your developer will ask you about.

Updated 2026-09-22

The Developers page is where an integration that is not Shopify — WooCommerce, a custom store, a till, an app — gets its credentials. Your developer will want the developer documentation; this article is the merchant's view of the same screen.

The Developers page with the key creator open
Advanced → Developers. Creating and managing keys needs an owner or admin.

API keys

Create an API key asks for three things:

  • Key name — name it after the system that will use it ("WooCommerce production", "Store till").
  • ModeTest writes to an isolated sandbox: its members, orders and points never appear in your analytics, liability or exports. Live writes to the real programme. Start with Test.
  • Scopes — what the key may do. ingest sends orders and events; read looks up members and balances; act changes balances (enrol, adjust, redeem); webhooks manages webhook endpoints. Grant the least the integration needs; act only if it really redeems or adjusts.

The key is shown once. Copy it into the other system straight away — we keep only a fingerprint, and cannot show it again.

Each key in Your keys shows its mode, scopes and when it was last used. Two buttons:

  • Rotate issues a replacement with the same scopes; the old key keeps working for 24 hours so you can swap it without downtime.
  • Revoke stops the key immediately, with no grace. Use it for a key that may have leaked.

Test mode

Test keys write to a twin of your programme with the same rules, tiers and settings. Wipe test data clears every test member, order and points entry and re-copies your current rules, so a test run starts clean and matches what live would do. Nothing in the real programme is touched.

Webhooks

A webhook endpoint is a URL on your system that StickyTier calls whenever something happens — a member joins, points move, a tier changes, a redemption completes, points are about to expire. Add the https address, tick the events, and copy the signing secret (shown once): your developer uses it to verify each delivery is genuine.

Under each endpoint: Send test event to check the wiring, Recent deliveries with a Redeliver button, Rotate secret, and Delete. A failed delivery is retried for about a day; after three deliveries fail completely the endpoint is switched off and shows Auto-disabled — fix the receiver, then Re-enable.

API activity

The card shows the last 24 hours — requests, successes, rejections, rate limits, errors — and the latest failed calls with their request id. Quote that id to support.

Store connection

Your Shopify connection lives on its own page, Setup → Store connection: connect a store, see what it last sent, check for missed orders and repair the connection. See Integrations & migration.

Developers & API keys — Knowledge base — StickyTier