Getting started

Authentication

Every request carries an API key in the Authorization header.

Header

Authorization: Bearer mk_live_XXXXXXXX:sk_live_XXXXXXXXXXXXXXXX

A key has two halves joined by a colon: the key id (mk_…, safe to log) and the secret (sk_…, never log it). Create keys in the dropshipping dashboard → Integrations.

Live and test keys#

Prefix	Mode	What happens
`mk_live_`	Live	Real orders: stock is reserved, the courier ships, your wallet moves.
`mk_test_`	Sandbox	Everything is validated, nothing ships, no money moves. See Sandbox.

Test and live data never mix: a test key only sees test orders, a live key only live ones.

Keys belong to a store connection#

Each key is created on an integration (one per store or app). Its webhook URL and secret belong to that integration too. If you run two websites, create two connections — their orders, webhooks and keys stay apart.

Keeping keys safe#

Call the API from your server only. Never put a key in browser JavaScript or a mobile app — anyone could read it and place orders on your wallet.
Keep them in environment variables or a secrets manager, not in your repository — for example MARKITMALL_API_KEY (the key id) and MARKITMALL_API_SECRET (the secret), joined as Bearer $MARKITMALL_API_KEY:$MARKITMALL_API_SECRET.
We store only a hash of the secret, so we cannot show it again. Lost it? Create a new key and revoke the old one.
Optionally restrict a key to your server's IP addresses when you create it. Calls from anywhere else get 403 ip_not_allowed.

Rotating a key#

Keys do not expire. To rotate without downtime:

Create a second key on the same connection.
Deploy it to your servers.
Revoke the old key in the dashboard — it stops working immediately.

Revoke a key immediately if it may have leaked. Disconnecting a store (or uninstalling the Shopify app / WordPress plugin) revokes every key of that connection.

Authentication errors#

HTTP	code	Meaning
401	`invalid_key`	Missing header, unknown or revoked key, or wrong secret.
403	`ip_not_allowed`	The key has an IP allowlist and this request came from another address.
403	`reseller_suspended`	Your dropshipper account is suspended; the message says why.
403	`reseller_not_active`	Live keys work once your application is approved (test keys work before).

Sandbox & testing →

Build and test with a test key.

Errors & limits →

All error codes, rate limits and retries.