> ## Documentation Index
> Fetch the complete documentation index at: https://www.twicecommerce.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# API Keys

> Authenticate external systems against the TWICE Commerce API with API keys.

API keys let external systems authenticate against the TWICE Commerce API — the same API that powers the admin. Use them for integrations, scripts, and headless storefronts.

## How it works

You create and manage API keys in [Settings → Integrations](/docs/settings/integrations) under **API access**. Each key belongs to your account and acts on its behalf.

<Warning>
  API keys are not scoped. Every key receives **owner-level permissions**: it can call every route on your account, including reads and writes to orders, customers, inventory, and settings. There are no per-key scopes or role restrictions. Treat a key like an owner password — store it as a secret, never commit it to source control, and rotate it immediately if it leaks.
</Warning>

All requests go to `https://server.twicecommerce.com`. Send the key in the `X-API-KEY` header on every request. For example, list your catalog items:

<CodeGroup>
  ```bash cURL theme={null}
  curl "https://server.twicecommerce.com/internal/catalog" \
    -H "X-API-KEY: {key}"
  ```

  ```json Response theme={null}
  {
    "data": [
      {
        "id": "b4f0a2ce-58d1-4f6e-9a1d-7c2e0f3a9b41",
        "name": "Trail Bike",
        "internalName": "trail-bike-2026",
        "status": "active",
        "taxonomyCategoryId": null,
        "createdAt": "2026-07-14T09:32:11.000Z"
      }
    ],
    "pagination": {
      "page": 0,
      "pageSize": 50,
      "total": 1,
      "totalPages": 1
    }
  }
  ```
</CodeGroup>

## Usage

1. Open [Settings → Integrations](/docs/settings/integrations) and go to **API access**.
2. Create a key and copy it — the full value is shown only once.
3. Add it to your integration as the `X-API-KEY` request header.
4. Revoke a key from the same screen when it is no longer needed.

## Rate limits

The API limits requests in three layers:

* **Per IP** — pre-authentication protection. Each client IP has a per-minute request budget. Requests with missing or bot-like user agents consume more of the budget per call.
* **Per account** — all authenticated traffic on your account, admin dashboard and API keys combined, shares a per-minute limit that scales with your plan.
* **Per API key** — each key has a sustained requests-per-second rate, a short-term burst allowance, and a monthly request cap. All three scale with your plan; the monthly cap is the API call allowance that pools across all your locations.

Responses carry rate limit headers:

| Header                  | Meaning                                                             |
| :---------------------- | :------------------------------------------------------------------ |
| `X-RateLimit-Limit`     | Request budget of the current limit window                          |
| `X-RateLimit-Remaining` | Requests left in the window                                         |
| `X-RateLimit-Reset`     | Unix timestamp (seconds) when the window resets                     |
| `Retry-After`           | Seconds to wait before retrying — sent with `429 Too Many Requests` |
| `X-RateLimit-Warning`   | Set when a key approaches its monthly cap                           |

When a request exceeds a limit, the API returns `429 Too Many Requests`. Wait for `Retry-After` seconds before retrying. See [pricing](/docs/twice-commerce-overview#pricing) for the allowances on each plan.

## Related

<CardGroup cols={2}>
  <Card title="API reference" icon="code" href="https://server.twicecommerce.com/api/internal">
    Browse every endpoint.
  </Card>

  <Card title="Webhooks" icon="webhook" href="/docs/concepts/integrations/webhooks">
    Receive events when data changes.
  </Card>

  <Card title="Integrations settings" icon="plug" href="/docs/settings/integrations">
    Manage keys and connected systems.
  </Card>
</CardGroup>