How Stoify's API Tools Keep Integrations Moving

An ecommerce platform becomes more useful when it can work with the rest of a team's stack without asking the team to rebuild the same catalog logic somewhere else. Stoify's latest API release is designed around that idea: secure keys, useful read endpoints, clear documentation, and limits that make integrations easier to operate in production.

A safer way to manage API access

API access starts with the key itself. Stoify now gives teams a dedicated API key workflow where keys can be named, reviewed, edited, regenerated, and revoked from the dashboard.

The full secret is shown only when a key is created or regenerated. After that, the dashboard keeps an abbreviated preview so a team can identify the key without exposing credentials. Security emails also notify the site owner when a key is created, regenerated, or revoked.

That creates a clearer operational loop:

• Name a key after the integration it belongs to.
• Store the full secret in the integration's secret manager.
• Regenerate it when credentials need to change.
• Revoke it immediately when access should end.

Public endpoints that stay close to the storefront

The first public API endpoints focus on the catalog workflows integrations need most often. Teams can list products, retrieve a product by slug, list categories, and list collections with familiar search, sorting, and pagination parameters.

The responses preserve useful storefront data without requiring an integration to know how Stoify's internal dashboard is assembled. Product responses include variants, images, categories, stock information, and review summaries where available, while collection and category responses remain focused on the fields needed to build a useful catalog experience.

Documentation belongs beside the workflow

The API reference lives in the dashboard next to API key management. Each endpoint includes its path, query parameters, cURL example, JavaScript example, and response shape.

That proximity matters. Developers can create or rotate a key, copy an example, and understand the response without moving between a settings page and a separate documentation system. It also gives the team building an integration a more direct way to test the shape of the catalog before writing more application code.

Rate limits make the API easier to depend on

The API now uses plan-aware limits across three windows: per second, per minute, and per hour. All three windows apply at the same time, and each API key has its own counters.

Free plans start at 5 requests per second, 100 per minute, and 1,000 per hour. Pro moves to 10, 500, and 10,000. Business supports 25, 2,000, and 50,000, while Enterprise supports 50, 10,000, and 250,000 across the same windows.

When a window is exceeded, the API returns a 429 response with reset and retry headers. That gives an integration enough information to slow down gracefully instead of treating a temporary limit as a broken endpoint.

A connected foundation for integrations

API keys, public endpoints, documentation, and rate limits are more useful together than as separate features. A key gives an integration controlled access. The endpoints provide a practical catalog surface. The reference makes the contract easier to understand. The limits make the whole workflow more predictable as usage grows.

Read more about API key management, public API endpoints, and API rate limiting, or compare the API quotas on the pricing page.