BreakingAPISecurity
Lock your storefront API to your own websites
Your store’s public key now works only from websites you register, and calls from your servers must carry the store’s secret. A copied key is no use to anyone else.
Browser calls carry an Origin, and are accepted only from the https:// websites you register. Cross-origin access is set per store and is never a wildcard. Calls without an Origin come from servers, and need the secret.
- Settings → Storefront API lists your websites, the calls that were refused and the date the lock starts.
- Rotate the public key with a seven-day overlap, so live sites keep working while you deploy the new one.
- Refusals say why:
ORIGIN_NOT_ALLOWED,BROWSER_CALLS_DISABLED,TENANT_SECRET_REQUIREDorTENANT_SECRET_INVALID. - All three starter storefronts refuse to start in production without the secret, and fail the build if it could reach a browser.
curl https://api.elaraone.app/api/v1/products \
-H "X-Tenant-Key: pk_live_…" \
-H "X-Tenant-Secret: $ELARAONE_TENANT_SECRET"
Follow every update with the RSS feed.