Authentication

API keys

Every request to the QUANTM7 API requires an API key in the Authorization header. Keys are scoped to a single store.

curl https://api.quantm7.com/v1/products \
  -H "Authorization: Bearer q7_pk_your_key_here"

Key types

QUANTM7 uses two key types with different access levels.

Publishable key (`q7_pk_`)

Safe to use in frontend code. Can only read data.

Fetch products, collections, blog posts, pages, menus, and store info
Cannot create carts or process checkouts
Rate limit: 100 requests per minute

Use this key in your Astro, Next.js, or Nuxt frontend to load product data at build time.

Secret key (`q7_sk_`)

Must stay on your server. Never expose it in client-side code.

Full read access to all endpoints
Create and manage carts
Process checkouts and create payment intents
Rate limit: 30 requests per minute

Use this key in API routes, server functions, or backend services.

Generating keys

Log in to your QUANTM7 dashboard
Go to Settings > API Keys
Click Generate Key and choose the key type
Copy the full key immediately. Secret keys are shown once and cannot be retrieved later.

Key security

Rule	Why
Never commit keys to version control	Use environment variables instead
Never expose secret keys in client-side code	Use publishable keys for frontend requests
Rotate keys if compromised	Revoke the old key and generate a new one
Use CORS allowlists for publishable keys	Prevents unauthorised domains from using your key

Environment variables

Store your keys in environment variables, not in code.

# .env
Q7_PUBLISHABLE_KEY=q7_pk_abc123...
Q7_SECRET_KEY=q7_sk_xyz789...

// Astro
const res = await fetch('https://api.quantm7.com/v1/products', {
  headers: { 'Authorization': `Bearer ${import.meta.env.Q7_PUBLISHABLE_KEY}` }
})

// Next.js
const res = await fetch('https://api.quantm7.com/v1/products', {
  headers: { 'Authorization': `Bearer ${process.env.Q7_PUBLISHABLE_KEY}` }
})

CORS

The API supports Cross-Origin Resource Sharing for browser-based requests.

Allowed origins

By default, requests from any origin are allowed. To restrict access, add your domains to the Allowed Origins list in Settings > API Keys.

When you add origins, only those domains can make requests with publishable keys. Requests from unlisted origins get a CORS error.

https://mystore.com
https://staging.mystore.com
http://localhost:3000

Preflight requests

The API handles OPTIONS preflight requests automatically. Allowed methods are GET, POST, PUT, DELETE. Allowed headers are Authorization and Content-Type.

Base URL

All API endpoints use the same base URL:

https://api.quantm7.com/v1/

Response format

Every response follows the same structure.

Success (single resource)

{
  "data": {
    "title": "Classic Tee",
    "handle": "classic-tee"
  }
}

Success (list with pagination)

{
  "data": [ ... ],
  "meta": {
    "page": 1,
    "per_page": 25,
    "total": 84
  }
}

Error

{
  "error": {
    "code": "unauthorized",
    "message": "Invalid or missing API key"
  }
}

See Errors and Rate Limiting for the full list of error codes.

Next steps

Store to fetch your store's basic info
Products to start loading product data

On this page