Platform API keys
A platform API key is a cross-store credential that lets your service call the catalog, cart, and checkout surfaces of every Artos store with a single key — the credential the hosted bridge holds, and the one a Build-track platform uses for everything except buyer-bound calls.
X-API-Key: ck_<clientId>.<secret>What it grants
A platform key is minted with isPlatform: true (no single store), so it is
accepted at any store and bypasses the per-store ownership check.
| Surface | Allowed with a platform key? |
|---|---|
| Global catalog search / lookup / product | Yes (also works anonymously) |
| Per-store cart create / update / view | Yes |
| Checkout create / update | Yes |
Card complete_checkout | Yes |
Store get_order | Only if the key was granted the orders:read permission |
Crypto prepare/complete, all /account/mcp tools | No — those are buyer-bound (buyer OAuth bearer only) |
It is not a payment instrument and not an AP2 key. Completing a purchase
still requires the purchase:complete permission and a signed AP2
checkout_mandate (Authentication).
The load-bearing rule: never attach the platform key to a buyer-bound call. The API prefers
X-API-Keyover a bearer, so sending both resolves the platform identity and the buyer (and their spend caps) never load.
When you need one
| Path | Platform key? |
|---|---|
| Connect an assistant (hosted bridge) | No — the bridge holds it |
| Catalog crawler (read-only) | Optional (anonymous works; a key adds stability) |
| Shopping agent (SDK) | Yes |
| Checkout handoff | Yes |
How to get one
Platform keys are issued by Artos — there is no self-service portal yet, and no public endpoint mints them.
Production: request a platform API key from Artos at hello@artos.sh. You will receive a
ck_<id>.<secret>pair and can specify whether it needs theorders:readpermission.
Treat the secret like any server credential: store it in your environment
(UCP_PLATFORM_API_KEY), never commit it, never ship it to a browser, and rotate
it by requesting a new pair.
Local development
For local and dev work the API seeds a platform credential so you don’t have
to wait on issuance — ck_artos_agent.ucp_artos_secret by default (override via
UCP_PLATFORM_CLIENT_ID / UCP_PLATFORM_CLIENT_SECRET). See
Local development.
Not the same as a merchant key
A platform key is cross-store and Artos-issued. Merchants mint their own
store-scoped client_credentials keys from the dashboard for their own
server-side automation — those are bound to one store and described in
For merchants.
Next steps
- Authentication — the full credential model, scopes, and trust tiers
- Shopping agent (SDK) — the main consumer of a platform key
- For merchants — store-scoped credentials instead