Merchant credentials
Store-scoped keys authenticate the widget and plugin API against one Shopify catalog. Create, copy, and rotate keys in the Merchant Portal — this public page never issues or displays live secrets.
Key types
Each Shopify store gets its own catalog, meters, and keys. Search, outfits, and try-on never read another merchant’s products.
ss_live_…Authenticates the deferred widget script and every plugin API call from the shopper browser.
data-api-key on the theme embed or Liquid snippetX-API-Key on plugin routes (with hashed visitor header)Used by: wardrobeit-widget.js · headless custom storefronts
sk_live_…Tighter-scoped credentials for approved backend integrations — not for theme Liquid or client-side JavaScript.
Used by: server-side catalog sync helpers, custom integrations
| Property | Plugin key | Merchant API key |
|---|---|---|
| Prefix | ss_live_ | sk_live_ |
| Where it runs | Storefront widget · plugin API | Your backend only |
| Shown at creation | Once — copy immediately | Once — copy immediately |
| Portal path | Connections & Catalog → plugin keys | Developer credentials (when enabled) |
| Auth header | X-API-Key + X-WardrobeIt-Visitor | Per onboarding doc |
Lifecycle
Keys follow a simple lifecycle: generate after store connect, copy once, embed in theme, validate on storefront, rotate if compromised, revoke when decommissioning.
OAuth from Portal → Connections & Catalog, or custom app token with read_products + read_content. Catalog sync runs in the background.
Portal generates ss_live_… for the connected store. The full value displays once — copy to your password manager before closing the panel.
Theme Editor → App embeds → WardrobeIt stylist. Paste widget key, API base URL (…/api/v1), and script URL. Or use the documented Liquid fallback.
Send a test message on homepage, collection, and PDP. Confirm product cards render and try-on appears only on eligible SKUs.
If a key leaks, rotate immediately from the portal and update the theme embed. Revoke unused keys. Keep development and production stores on separate keys.
Portal & embed
After OAuth connect, copy the widget key from Connections & Catalog and paste it into the theme app embed or Liquid snippet — along with your API base URL and script URL.
| Setting | Example | Notes |
|---|---|---|
| Widget API key | ss_live_… | From portal after connect |
| API base URL | https://api.wardrobeit.com/api/v1 | Must match your WardrobeIt host |
| Widget script URL | …/wardrobeit-widget.js | CDN or API static path |
| Widget title | Stylist | Panel header label |
<script src="https://YOUR_HOST/static/wardrobeit-widget.js"
data-api-key="ss_live_…"
data-api-base="https://YOUR_HOST/api/v1"
data-page-type="product"
data-product-id="{{ product.metafields.wardrobeit.id }}"
defer></script>Security & FAQ
Plugin keys are store-scoped and designed for storefront traffic — still rotate if leaked. CORS restricts origins. Visitor identity uses a hashed header, not email, on plugin routes.
429 as back off; limits apply per key and visitor.No — full values display once. Rotate to generate a new key if you did not save the original.
Yes for ss_live_… storefront keys — that is the intended embed model. Never put sk_live_… merchant API keys in Liquid or client-side JavaScript.
X-API-Key: ss_live_… plus X-WardrobeIt-Visitor (hashed visitor id). See the developer API section for endpoint reference.
Commercial questions: Contact. Technical onboarding (API host, CORS, metafields): your WardrobeIt counterpart or Book a Demo.
Connect Shopify, copy your widget key, embed the stylist, and validate on a development store before go-live.