Skip to main content

Fourthwall API Surfaces: Which API Does My Key Authenticate With?

Updated October 26, 2026

Match each developer credential to the Fourthwall API surface it actually authenticates against

Two Fourthwall APIs use the credentials from Settings > For developers, and each accepts a specific credential sent a specific way. Use this article to confirm which API your credential works against before you start sending requests, or to diagnose a 401 response after you have.

There's one credential for each of these APIs:

  1. Open API username and password (from the Open API section). Sent with Basic auth to the Platform Open API.
  2. Storefront API token (from the Storefront API section). Authenticates against the Storefront API only.

The Storefront API token is sent as the storefront_token query parameter in the request URL. The two credentials are not interchangeable. Looking for the Product Offer Open API? See Product Offer Open API.

Where do I get each credential?​

Both credentials live on the same dashboard page, in different sections.

  1. Go to Settings > For developers in your Fourthwall dashboard.
  2. Find the section that matches the API you want to call:
    • Open API for the Platform Open API. Click Create API User if you haven't yet, then copy the username and password it shows. Only a user with the Super Admin role can create an API user. If the dashboard asks you to confirm with a code sent to your email (or with a passkey) when you open For developers, enter the code to see this page.
    • Storefront API for the Storefront API. Click Create token.
  3. Treat both credentials like a password.

Open API settings, showing username and password fields with a copy button. Also lists webhooks and storefront API settings.

How do I use the Open API username and password?​

The Open API section uses Basic auth. Your Open API username and password authenticate against the Platform Open API.

Platform Open API​

Host: api.fourthwall.com/open-api/v1.0/

The Platform Open API exposes endpoints for shop data. Common endpoints include:

  • /shops/current for the shop your credentials belong to
  • /products for your full product catalog
  • /order for order records (the path is singular)

Use this API when you need read or write access to platform-level data such as orders, products, and account info.

Sending the credential​

Send your username and password with HTTP Basic auth on every request. Most tools do this for you. For example, with curl:

curl -u YOUR_USERNAME:YOUR_PASSWORD https://api.fourthwall.com/open-api/v1.0/products

Basic auth sends the header Authorization: Basic followed by the Base64 encoding of YOUR_USERNAME:YOUR_PASSWORD. Don't send the username or password as an Authorization: Bearer token.

How do I use the Storefront API token?​

The token you create in the Storefront API section is a separate credential. In code and starter templates it is often referred to as storefront_token.

Host: storefront-api.fourthwall.com

The Storefront API powers custom headless storefronts. It serves product data and cart actions, and redirects customers to the Fourthwall-hosted checkout. For the full feature set, see Storefront API.

Send the token as the storefront_token query parameter in the request URL. For example, this request fetches your collections:

GET https://storefront-api.fourthwall.com/v1/collections?storefront_token=YOUR_STOREFRONT_TOKEN

Replace YOUR_STOREFRONT_TOKEN with your token. An Authorization: Bearer header on its own isn't Storefront API authentication, so always use the query parameter. The Storefront API overview documents this example.

Quick lookup​

Credential sourceSends toHostHow to send it
Open API sectionPlatform Open APIapi.fourthwall.com/open-api/v1.0/Basic auth (username and password)
Storefront API sectionStorefront APIstorefront-api.fourthwall.com?storefront_token=... query parameter

Picking the right credential for your project​

  • Building a custom headless storefront with product browsing, cart, and checkout redirect? Click Create token in the Storefront API section.
  • Reading or writing platform data (orders, account info, full product records)? Use your Open API username and password and call the Platform Open API at api.fourthwall.com/open-api/v1.0/.
  • Building an installable third-party app that other creators authorize through OAuth? Register an app under Settings > Platform apps instead of sharing your own credentials. See Developer Platform.

Troubleshooting 401 responses​

A 401 from the Platform Open API or the Storefront API almost always means the wrong credential, or the right credential sent the wrong way.

Check these in order:

  1. Confirm the section. Did the credential come from the Open API section or the Storefront API section? A Storefront API token will not authenticate against api.fourthwall.com. Open API credentials will not authenticate against storefront-api.fourthwall.com.
  2. Confirm Open API requests use Basic auth. Send your username and password with Basic auth, not as an Authorization: Bearer token.
  3. Confirm the Storefront API token is in the URL. Storefront API requests need the storefront_token query parameter; an Authorization: Bearer header alone doesn't replace it. A missing or incorrect storefront_token value can cause a 401, so check that it's present and matches your token.
  4. Confirm the host. The Platform Open API is at api.fourthwall.com and the Storefront API is at storefront-api.fourthwall.com.
  5. Confirm the credential is current. If you regenerated or rotated the credential, older clients still using the old value will start returning 401.

If all five check out and you still get a 401, contact support@fourthwall.com with the host you are calling and the section you got the credential from.

Frequently asked questions​

Can I use one credential for every Fourthwall API?​

No. The Open API username and password cover the Platform Open API. The Storefront API token covers only the Storefront API. You need both if your integration calls both.

Are the Open API credentials and Storefront API token rate-limited?​

Yes. Most Platform Open API endpoints allow 100 requests per 10 seconds per shop, and a few write endpoints are tighter (for example, 5 per minute for POST /products). Over the limit, the API returns 429 Too Many Requests; wait and retry. See the rate limiting guide for the current numbers. The Storefront API reference doesn't publish limits, so throttle requests if you make many in a short period.

Where do I find the full reference for each API?​

Each section in Settings > For developers has a Learn more link. The Open API link opens docs.fourthwall.com/guides/overview, and the Storefront API link opens docs.fourthwall.com/storefront.

Was this helpful?