Authentication

Storefront requests are authenticated with a project API key. Keys are issued per project in the dashboard under Project settings → API keys. There are two key types plus a separate customer token for logged-in shopper routes.

Key types

Key	Prefix	Use
Publishable key	`wt_pk_…`	Browser storefronts. Safe to ship in client-side JavaScript. Origin-checked when the project configures allowed origins.
Secret key	`wt_sk_…`	Trusted server-side code and AI agent integrations. Never expose in a browser — requests carrying a browser Origin header are rejected. Secret keys carry scopes for agent docs, seeding and writes.

Issue and revoke keys in the dashboard under Project settings → API keys.

Request headers

Header	Value	Notes
`X-Project-Key`	`wt_pk_… or wt_sk_…`	Preferred header for browser clients. Required when the project sets require_publishable_key = true; otherwise optional on read routes. Invalid keys are always rejected — they are never treated as anonymous.
`Authorization: Bearer <key>`	`wt_pk_… or wt_sk_…`	Alternative to X-Project-Key for server clients.
`Authorization: Bearer <customer token>`	`customer access token`	Returned by POST …/customers/login and …/customers/register. Required on /customers/me/* routes.
`X-Cart-Token`	`cart token`	Returned by POST …/carts. Identifies an anonymous cart on cart and checkout routes.

Browser storefront

fetch("https://api.webtools.ng/api/v1/storefront/projects/your-project/products", {
  headers: { "X-Project-Key": "wt_pk_your_key" },
});

Server / agent

curl "https://api.webtools.ng/api/v1/storefront/projects/your-project/products" \
  -H "Authorization: Bearer wt_sk_your_secret_key"

Rules

Storefront routes only ever read or write published, public data. CRM records are never exposed on the storefront.
A request for a resource in another project fails closed with 404.
When a project feature is disabled, its routes return 404 rather than leaking partial behaviour.

Secret keys also carry scopes for agent documentation, seeding and writes — see the AI agent integration guide.