Build on SitesPlaced

What you can build

Quick start in 3 steps

1. Create a key

An API key is a password for a program. Open your store in the dashboard, go to Settings → Developer and create one. Pick secretfor code that runs on a server, and give it only the permissions it needs. The full key is shown once, so copy it straight away and keep it in your server's environment settings.

You need a SitesPlaced store for this. The free plan is enough. If the person who owns the store is not a developer, send them the Help Center guide to API keys.

2. Make a request

GET /me accepts any valid key and tells you which store the key belongs to. Send the key in the Authorization header. A key in the URL is refused.

curl https://sitesplaced.com/api/v1/me \
  -H "Authorization: Bearer sp_live_sk_your_key_here"

{
  "api_version": "v1",
  "store": {
    "id": "uuid",
    "name": "Asha Jewels",
    "slug": "asha-jewels",
    "url": "https://asha-jewels.sitesplaced.site",
    "tracking_url": "https://asha-jewels.sitesplaced.site/track-order",
    "currency": "INR",
    "mode": "full"
  },
  "key": { "kind": "secret", "scopes": ["orders:read"], "connection_id": null },
  "limits": { "requests_per_minute": 60 }
}

Always use https://sitesplaced.com/api/v1, without www.

3. Handle the response

• Check the HTTP status first. Anything from 400 up carries an error object with a fixed code, a message in plain words, and a request_id.
• A 429 means you went over the rate limit. Wait for the number of seconds in the Retry-After header, then try again.
• Every response has an X-Request-Id header. Log it. If you ever ask us for help, that id finds the exact call.

const res = await fetch("https://sitesplaced.com/api/v1/me", {
  headers: { Authorization: `Bearer ${process.env.SITESPLACED_KEY}` },
});
const body = await res.json();

if (!res.ok) {
  // Every error has the same shape. The request id finds the call in our logs.
  const { code, message, request_id } = body.error;
  if (res.status === 429) {
    const waitSeconds = Number(res.headers.get("Retry-After"));
    // wait that long, then try again
  }
  throw new Error(`${code}: ${message} (${request_id})`);
}

console.log(body.store.name, body.limits.requests_per_minute);

From here, the API reference has every route with request and response examples.

Two kinds of key

What is done to protect a key:

• SitesPlaced stores only a hash of each key. A hash is a one-way fingerprint, so the key itself cannot be read back. This is why a key is shown once.
• Each key has its own list of permissions, and any key can be revoked on its own without touching the others.
• A secret key sent from a web browser is refused. A publishable key is refused from any website that is not on its allowed list.
• Webhooks and the updates sent to a connected shop are signed, so the receiver can check they came from SitesPlaced.

What it costs

A paid store plan means Growth or AI Co-founder. Prices are on the pricing page. If a paid plan ends, the limits drop back to the free ones and nothing is deleted.

Where to go next

1. API reference: authentication, permissions, errors, paging, the order object, every route, webhooks, the headless checkout and tracking.
2. WooCommerce plugin: install the zip, connect, what is copied and what is sent back. You can also download the plugin directly.
3. Shopify connector: early access. What it will do and how to ask for it.
4. MCP server: connect ChatGPT, Claude or Cursor.
5. A machine-readable description of the API, in the OpenAPI 3.1 format, is at /api/v1/openapi.json. Tools can read it to generate a client.