Authentication

Your Domain Key runs in the browser; secret keys run on your server.

Print.App uses two kinds of keys.

Key	Looks like	Where it runs
Domain Key	dom_…	In page JavaScript, to load the editor. Public: safe to ship in browser code.
Secret key	sk_…	On your server, to call the REST API. Never put it in browser code, a mobile app or a public repository.

The older Auth Key shown under Domains is for the v1 endpoints and the store plugins. The v2 API does not accept it.

Create a secret key

1. In the Print.App admin, open Domains and expand your current domain.
2. Next to Secret keys, click Manage, then New secret key. Give it a label, such as Production server.
3. Copy the key straight away. It is shown only once: Print.App stores a hash of it, not the key itself.

Keys belong to the domain that is current when you create them. An account can hold up to 10 secret keys at a time.

Use it

Send the key as a bearer token on every request:

cURL

curl https://api.print.app/v2/account \
  -H "Authorization: Bearer $PRINTAPP_SECRET_KEY"

A missing, unknown, revoked or expired key answers 401 with the code unauthorized. If the account is suspended for an unpaid invoice, requests answer 403 with account_suspended.

Rotate a key

Rotating replaces a key without downtime. Click Rotate on the key and choose how long the old key keeps working: stop it now, or keep it for 1 hour, 24 hours or 7 days. You get a new key with the same label, shown once. Deploy it to your server before the old one stops.

If a key may have leaked, rotate it with Stop the old key now.

Revoke a key

Click the trash icon on a key. Requests using it are refused within a minute. Revoking can’t be undone.