Authentication

Plus API requests require:

http

Authorization: Bearer <token>
X-GiftDesk-Shop: your-shop.myshopify.com

Tokens

Production tokens are HMAC-SHA256 of the shop domain with your provisioned GIFTDESK_PLUS_API_SECRET, prefixed gd_.

Contact support@giftdesk.app after upgrading to Plus to receive credentials.

Dogfood environments may use a provisioned GIFTDESK_PLUS_API_TOKEN when configured.

Plan gate

Only shops on Plus or an active trial may call the API. Others receive 403.