API Keys

API keys let external systems authenticate against the TWICE Commerce API — the same API that powers the admin. Use them for integrations, scripts, and headless storefronts.

The TWICE Admin API is in alpha. Endpoints and schemas can change without notice. Pin an API version — see API versions below — and check the reference before you upgrade an integration.

How it works

You create and manage API keys in Settings → Integrations under API access. Each key belongs to your account and acts on its behalf.

API keys are not scoped. Every key receives owner-level permissions: it can call every route on your account, including reads and writes to orders, customers, inventory, and settings. There are no per-key scopes or role restrictions.Treat a key like an owner password — store it as a secret, never commit it to source control, and rotate it immediately if it leaks.

All requests go to https://server.twicecommerce.com. Merchant-facing endpoints live under /v1/admin/ — the TWICE Admin API. Send the key in the X-API-KEY header on every request. For example, list your catalog items:

curl "https://server.twicecommerce.com/v1/admin/catalog" \
  -H "X-API-KEY: {key}"

{
  "data": [
    {
      "id": "b4f0a2ce-58d1-4f6e-9a1d-7c2e0f3a9b41",
      "name": "Trail Bike",
      "internalName": "trail-bike-2026",
      "status": "active",
      "taxonomyCategoryId": null,
      "createdAt": "2026-07-14T09:32:11.000Z"
    }
  ],
  "pagination": {
    "page": 0,
    "pageSize": 50,
    "total": 1,
    "totalPages": 1
  }
}

Usage

Open Settings → Integrations and go to API access.
Create a key and copy it — the full value is shown only once.
Add it to your integration as the X-API-KEY request header.
Delete a key from the same screen when it is no longer needed. A Delete API key dialog asks you to confirm. Every integration authenticating with that key stops working the moment you confirm, and deleting cannot be undone.

API versions

The API is versioned by date. The current version is 2025-06. Send the version in the X-API-Version header to pin a request to it:

curl "https://server.twicecommerce.com/v1/admin/catalog" \
  -H "X-API-KEY: {key}" \
  -H "X-API-Version: 2025-06"

A request that sends no version header — or a version the API does not recognise — targets the latest version. Pin the header on an integration you do not want moving under you when a new version ships. Webhooks are pinned separately: each webhook keeps the version that was latest when you created it, so a new API version never changes a payload you already receive. See Webhooks.

Integrations written against the older https://server.twicecommerce.com/internal/… paths keep working — those URLs resolve onto /v1/admin/. There is no need to rewrite a running script. Write new integrations against /v1/admin/.

Rate limits

The API limits requests in three layers:

Per IP — pre-authentication protection. Each client IP has a per-minute request budget. Requests with missing or bot-like user agents consume more of the budget per call.
Per account — all authenticated traffic on your account, admin dashboard and API keys combined, shares a per-minute limit that scales with your plan.
Per API key — each key has a sustained requests-per-second rate, a short-term burst allowance, and a monthly request cap. All three scale with your plan; the monthly cap is the API call allowance that pools across all your locations.

Responses carry rate limit headers:

Header	Meaning
`X-RateLimit-Limit`	Request budget of the current limit window
`X-RateLimit-Remaining`	Requests left in the window
`X-RateLimit-Reset`	Unix timestamp (seconds) when the window resets
`Retry-After`	Seconds to wait before retrying — sent with `429 Too Many Requests`
`X-RateLimit-Warning`	Set when a key approaches its monthly cap
`X-RateLimit-Overage`	Set to `true` when a request past the monthly cap was served and billed as overage instead of rejected

When a request exceeds a limit, the API returns 429 Too Many Requests. Wait for Retry-After seconds before retrying. Crossing the monthly cap does not always return 429. Accounts with overage enabled get the request served and billed as overage instead; accounts without it get 429 on every call past the cap. A request the burst limit rejects never reaches the monthly cap, so it is not counted against it. See pricing for the allowances on each plan.

API reference

Browse every endpoint.

Webhooks

Receive events when data changes.

Bulk creation

Create many records in one call instead of a loop.

Integrations settings

Manage keys and connected systems.

Welcome to TWICE Docs

Navigating in TWICE

Understand the system

How it works

Usage

API versions

Rate limits

API reference

Webhooks

Bulk creation

Integrations settings

​How it works

​Usage

​API versions

​Rate limits

​Related articles

API reference

Webhooks

Bulk creation

Integrations settings

How it works

Usage

API versions

Rate limits

Related articles