Skip to main content

Manage form keys

What does this do for me?

A public form key lets your published storefront forms submit applications for your shop. You issue the key from Settings and paste it into your theme block. You can rotate it if it is compromised and restrict which origins may use it.

1. Open Settings

Open Settings in the Customer Gate navigation. The page shows your Current embed configuration and a Form keys table.

2. Issue a form key

In the form key section, select Issue form key. When the key is ready, the Copy this form key now card shows the value once. This value cannot be retrieved again, so copy it to your embed before selecting I have saved this key.

3. Understand the configuration

The Current embed configuration card shows:
  • Key status — Active, or No active form key.
  • Submission URL — the storefront submission endpoint.
  • Access URL — the access-evaluation endpoint.
  • Storefront origin — kept in sync from Shopify.
  • Additional headless origins — for separate headless storefronts.

4. Rotate or edit a key

  • Select Rotate form key to issue a new key that replaces the active one.
  • In the Form keys table, select Edit on an active key to change its Form key label or Additional headless origins (comma-separated). The store’s own storefront origin is always included when a key restricts origins, so you never type a shop domain.

5. Restrict origins

The store’s primary storefront origin is added from Shopify automatically. A key with an empty allowlist is permissive (any origin). To restrict, add the additional headless origins for separate storefronts; the Shopify-managed storefront origin is always included in a restricted key.