Developer API keys, request limits and errors

Read this first if you are connecting your own code, an ERP or a billing system to your Zepio store. It covers what every endpoint has in common: keys, limits and errors.

Where: Admin › Settings › Developer API

Create an API key

1. Go to Settings › Developer API and click Create API key.
2. Give the key a name you will recognise later, for example "Tally sync".
3. Tick only the abilities this key needs. A key for stock sync needs Update products and nothing else.
4. Optionally set an expiry date. A key with no expiry works until you delete it.
5. Copy the key when it is shown. It is shown only once. If you lose it, delete the key and create a new one.

A store can have up to 20 API keys.

Abilities

Send the key

Every request goes to your own store domain and carries the key as a Bearer token.

https://yourwebsite.com/api/developer/v1

Authorization: Bearer YOUR_API_KEY
Accept: application/json

Test your key

GET /me works with any valid key. It tells you which store the key belongs to, what it can do and your request limits. It is the quickest way to check a new key.

curl -X GET "https://yourwebsite.com/api/developer/v1/me" \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Accept: application/json"

{
  "success": true,
  "message": "OK",
  "data": {
    "store": "yourstore",
    "key": {
      "name": "Tally sync",
      "abilities": ["products:update"],
      "expires_at": null,
      "created_at": "2026-10-17T06:52:53+00:00"
    },
    "rate_limits": {
      "read": 60,
      "product_sync": 2,
      "order_write": 30,
      "content": 10
    }
  }
}

Request limits

Zepio sets these limits for every store. They are per minute, per store, and shared by all your API keys. Creating more keys does not give you more requests.

Every successful reply tells you where you stand:

X-RateLimit-Limit: 60
X-RateLimit-Remaining: 42

Stay inside the limits

• Let Zepio tell you about orders. Instead of asking GET /orders every minute, add a webhook. Zepio sends each new order and status change to your URL as it happens, and webhooks do not count towards your limits.
• Send changes in bulk. One product update request can carry up to 2000 products. Send one request with all your changes, not one request per product.
• Ask only for what changed. Use updated_after on orders and products, and created_after on orders and customers, with the time of your last sync.
• Use per_page=100 when you read lists, so you need fewer requests.
• Wait when you are told to. If you get a 429, wait for retry_after seconds before you try again.

Errors

Every error reply has success: false and a message.

Too many requests

{
  "success": false,
  "message": "Rate limit exceeded.",
  "retry_after": 41
}

A request that gets 429 is not processed at all. Nothing in it is saved, so send it again after the wait.

If the same server keeps sending a wrong or deleted key, after 20 failed requests in a minute it starts getting 429 instead of 401 for those requests. Valid keys from that server keep working.

Keep your keys safe

• Treat a key like a password. Keep it on your server, never in a website, app or public code.
• Give each integration its own key with only the abilities it needs. If one leaks, delete just that key.
• Delete keys you no longer use. Last used on each key shows whether it is still in use.

Related

• Webhooks: get new orders instantly
• Connect Claude to your store
• Products API
• Update products in bulk
• Orders API: read orders and update their status
• Customers API
• Blog API