# Authentication

> Authenticate Storefront API requests with your workspace's publishable key, sent as a bearer token.

Breadcrumb: Storefront API › Authentication · Updated: 2026-10-17
Docs index: https://docs.cevoid.com/developers/llms.txt

The Storefront API authenticates every request with your workspace's publishable key. Scopes are not required.

## Find your publishable key

Your workspace's publishable key is in the Publishable key panel on [Settings → Integrations → Cevoid API](https://app.cevoid.com/settings/integrations/api). Publishable keys start with `cev_pk_`.

Use this key for storefront reads, including server-rendered [rich snippets](https://docs.cevoid.com/developers/storefront-api/rich-snippets.md). It identifies your workspace but cannot perform authenticated management actions. Save it in your storefront configuration.

## Send the key

Send your publishable key as a bearer token:

```http
Authorization: Bearer cev_pk_example
```

For example, to fetch posts for a market:

```bash
curl "https://api.widget.cevoid.com/v1/posts?market=mar_sweden" \
  -H "Authorization: Bearer ${CEVOID_PUBLISHABLE_KEY}"
```

A request without a key, or with any key that is not a publishable key, returns `401` with the code `unauthorized`. Secret keys do not work with the Storefront API.

## Publishable and secret keys

The Storefront API reads public storefront data only. To read or change workspace data from your server, use the Cevoid API with a scoped secret key: see [Authentication](https://docs.cevoid.com/developers/api/authentication.md).

Some storefront integrations use both. A [custom UGC experience](https://docs.cevoid.com/developers/storefront-api/custom-ugc.md) fetches posts with the publishable key, but discovers market IDs and curation labels on your server with a secret key, through `GET /v2/markets` and `GET /v2/labels`.

---

Canonical: https://docs.cevoid.com/developers/storefront-api/authentication