# Build anything on Shoprocket

> Build on Shoprocket: a drop-in widget, a REST API with storefront and seller surfaces, and signed webhooks. The same API the dashboard runs on.

A drop-in widget, a REST API and signed webhooks. The same API the Shoprocket dashboard runs on, so nothing is dashboard-only by accident.

### [Embed the widget](https://v3.shoprocket.io/docs/embedding.md)

Drop Shoprocket into any site, CMS, or builder. One script tag and your products and checkout are live.

### [Authentication](https://v3.shoprocket.io/docs/authentication.md)

Publishable keys for storefronts, secret keys with scopes for your server, and the two tokens a shopper carries.

### [Webhooks](https://v3.shoprocket.io/docs/webhooks.md)

32 events across orders, customers, products, stock, discounts, categories, subscriptions and licence keys, signed the same way Stripe signs its own.

### [REST API reference](https://v3.shoprocket.io/docs/api.md)

Every endpoint with its request and response schema, generated from the API itself, with a built-in client.

## How it fits together

Every Shoprocket store has three things you interact with as a developer:

- **The widget.** A JavaScript bundle you embed on your own site. It renders the catalogue, cart and checkout, and calls the storefront API for you. You never touch that API directly unless you want a fully custom (headless) build. Your own scripts can drive it and hear what shoppers do in it, for custom buttons and conversion tracking: see the [widget JavaScript API](https://v3.shoprocket.io/docs/javascript.md).
- **The storefront API.** The browser-safe API the widget speaks: read products, build a cart, check out, sign a shopper in. It is addressed by the store's publishable key, which is public by design.
- **The seller API.** For your own server: create products, adjust stock, read and fulfil orders, issue refunds, manage webhooks. It takes a secret key, and each key carries only the permissions you give it.

Starting from scratch?

Most integrations begin with the widget: add the script tag, and your catalogue and checkout are live. The [quickstart](https://v3.shoprocket.io/docs/quickstart.md) walks through it, and through a storefront in your own design, step by step. Building with an AI code builder? Point it at [/llms.txt](https://v3.shoprocket.io/llms.txt).

Already on Shoprocket v2?

Old embed snippets and `/v1` reads keep working when a store moves. [Moving from v2](https://v3.shoprocket.io/docs/moving-from-v2.md) lists what changes and the v3 call for each v2 one.

A new store starts in [test mode](https://v3.shoprocket.io/docs/test-mode.md). Until it connects a real way to pay, its checkout pays through a built-in test gateway, those orders are marked as tests, and their webhooks go only to test endpoints. Build the whole integration there before the store goes live.

## Base URLs

| API | Base URL | Auth |
| --- | --- | --- |
| Storefront | `https://api-v3.shoprocket.io/v3/public/{publishableKey}` | Publishable key, in the path |
| Seller | `https://api-v3.shoprocket.io/v3/stores/{storeId}` | Secret key: Authorization: Bearer sk\_... |

HTTPS only, JSON in and out. Storefront endpoints are safe to call from a browser. Seller endpoints must only be called from your server, because a secret key must never reach a client.

---

- HTML version: https://v3.shoprocket.io/docs
- Language: English (en)