API Key

The API Key authenticates server-to-server calls to the External Integrations API (/api/integrations/v1/*). Use it to manage your shop, sync your catalog, track conversions, verify your domain, and query analytics.

Header

Authorization: Bearer <api-key>

Characteristics

• Permanent until rotated: does not expire by time.
• Bound to a shop: the backend resolves the shopId automatically from the key. You don't need to include it in the URL.
• Server-to-server: must be sent from your backend. Does not work from browsers.

Don't embed the API Key in the frontend

Treat the API Key as a server-only secret. If it leaks in HTML or browser JavaScript, an attacker could use it from their own server.

Getting your key

From the Neuroon Dashboard:

1. Go to your shop settings.
2. Copy the API Key shown in the integration section.
3. Store it in your secret manager.

Separate environments

Production and Development have different API Keys. A Development key does not work in Production and vice versa. Use different environment variables for each environment.

Rotation

To rotate the API Key:

1. Go to Dashboard → shop settings.
2. Generate a new key — the previous one is invalidated immediately.
3. Update your environment variables and deploy.

If a key is leaked

Rotate immediately from the Dashboard. The previous key is invalidated instantly. Audit your logs and redeploy your services with the new key.

Storage

Places where you should store it:

• .NET: User Secrets in development, Azure Key Vault or appsettings.{Environment}.json mounted as secret in production. Never in plain web.config or hardcoded.
• WordPress: define in wp-config.php (outside the docroot) or encrypted in wp_options.
• General: AWS Secrets Manager, Azure Key Vault, HashiCorp Vault, GitHub Actions Secrets, Doppler, etc.

Places where you should never store it:

• Git repositories (public or private).
• Logs, exported traces, user-visible error messages.
• HTML attributes (data-api-key="...").
• Browser JavaScript variables.

Examples per stack

cURL

curl -X POST "https://api.neuroon.ai/api/integrations/v1/products/sync" \
-H "Authorization: Bearer $NEUROON_API_KEY" \
-H "Content-Type: application/json" \
-d '{
  "syncType": "INCREMENTAL",
  "products": [{
    "externalId": "demo-001",
    "name": "Premium T-Shirt",
    "price": 29.99,
    "currency": "EUR",
    "url": "https://yourstore.com/p/demo-001"
  }]
}'

Node.js / TypeScript

const res = await fetch(
  `${process.env.NEUROON_API_URL}/api/integrations/v1/products/sync`,
  {
    method: 'POST',
    headers: {
      'Authorization': `Bearer ${process.env.NEUROON_API_KEY!}`,
      'Content-Type': 'application/json',
    },
    body: JSON.stringify(payload),
  },
);

.NET / C#

var apiKey = builder.Configuration["Neuroon:ApiKey"]
             ?? throw new InvalidOperationException("Missing Neuroon:ApiKey");
var apiBase = builder.Configuration["Neuroon:ApiBaseUrl"]
              ?? "https://api.neuroon.ai";

using var client = new HttpClient { BaseAddress = new Uri(apiBase) };
client.DefaultRequestHeaders.Authorization =
    new System.Net.Http.Headers.AuthenticationHeaderValue("Bearer", apiKey);

var response = await client.PostAsJsonAsync(
    "/api/integrations/v1/products/sync", payload);
response.EnsureSuccessStatusCode();

Python

import os, requests

response = requests.post(
    f"{os.environ['NEUROON_API_URL']}/api/integrations/v1/products/sync",
    headers={
        "Authorization": f"Bearer {os.environ['NEUROON_API_KEY']}",
        "Content-Type": "application/json",
    },
    json=payload,
    timeout=30,
)
response.raise_for_status()

Errors

Code	Typical message	Cause
401	authenticationRequired	Missing Authorization: Bearer <key> or invalid format
404	shopNotFound	Shop not found for this API key
402	quotaExceeded	Product or search limit exceeded — upgrade your plan
422	unprocessableEntity	searchLogId not found or expired (conversions)
429	rate_limit_exceeded	Rate limit exceeded

Further reading

• Widget Token — frontend authentication.
• Rate Limits — quotas and backoff.
• Errors — full structure.