Get your API key and use the Filemonk API

Use this guide if you want to connect your own systems or an AI assistant to Filemonk. The API reads and changes your Filemonk data: orders and their downloads, files, digital products, licence keys, customers, download logs, emails, settings, imports, exports and analytics. Every request authenticates with a private API key you create in your settings. Each key expires, and you can have several at once.

API v2 is in beta, so details may still change. It uses the same API keys as API v1, and existing v1 integrations keep working.

Start here

• Send the key in the X-Auth-Token header (X-API-Key and Authorization: Bearer also work). API v1 and API v2 (beta) use the same key.
• Every action is documented at docs.filemonk.io, one page per action with examples. The same list is at /api/v2/external/openapi.json on your Filemonk app’s address (https://app.filemonk.io for most stores). A key only works on the app it came from.
• Confirm before big changes. An AI assistant should ask you before it deletes anything, emails customers in bulk, or does anything that charges. Bulk deletes of licence keys, licence tags and files need confirm: true, sent only after you agree; without it, Filemonk answers with how many records would go and deletes nothing.

Before you begin

Treat the key like a password. Anyone holding it can act on your store’s Filemonk data, so keep it out of client-side code, public repositories, and screenshots.

Create a key

1. Click Filemonk in the left menu of your Shopify admin.
2. Click Settings in the app’s menu, then open the Other tab.
3. Scroll to the API section and click Create API key.
4. Give the key a name that says where it will be used (for example Zapier or ERP sync), choose when it expires (30 days, 90 days, 1 year, or No expiry; 90 days is the default), and click Create API key.
5. Copy the key from the green banner. This is the only time the full key is shown. Afterwards the list shows only its first characters, its expiry date (Never for a key with no expiry) and when it was last used.

Send it with each request in the X-Auth-Token header. Keys start with fm_key_.

We email the store owner 14 days and 3 days before a key expires. Once a key has expired, requests with it get a 401 that says it expired. A key with no expiry never expires and gets no reminder emails, so revoke it yourself when you stop using it.

To open the documentation, look under API reference in the same card and click API v2 reference (beta) or API v1 reference.

Where the documentation is

Document	Address	Use it for
API v2 reference (beta)	docs.filemonk.io/v2	Guides, and a page for every v2 action with its parameters and examples
API v2 OpenAPI file	https://app.filemonk.io/api/v2/external/openapi.json	The same reference as one file, for code generators and tools
API v2 guide for AI agents	https://app.filemonk.io/api/v2/external/skill.md	The same actions written as instructions an AI assistant can follow
Index for AI agents	https://app.filemonk.io/llms.txt	The starting point that links everything else
API v1 reference	docs.filemonk.io	Existing v1 integrations, which keep working with the same key

To have an AI app such as Claude or ChatGPT work with Filemonk, connect it from Settings > Other > AI connectors instead of giving it this key. See Connect Claude or ChatGPT to Filemonk. For a script or agent you build yourself, give it the llms.txt address and put the key in its configuration, never in a chat.

Rotate a key before it expires

Click Rotate beside the key. You get a new key straight away, with the same name. Choose when it expires (the old key’s choice is preselected). The old key keeps working for 7 more days so you can update your integration without downtime. The old key then stops on its own.

Revoke a key

If a key has leaked, or someone with access has left, click Revoke beside it. It stops working on the next request. Your other keys keep working, so give each integration its own key and you can cut off just one.

The old key that never expires

Stores that used the API before expiring keys existed have one old key (it starts with fm_api_key_). It stops working on February 1, 2027. Until then it works, and responses to it carry a Deprecation header and a Sunset header with that date. A new key works alongside it, so you can switch without downtime. To move off it:

1. Create a new key as above and put it into each integration that used the old one.
2. Check the old key’s Last used date in the yellow banner stops moving.
3. Click Revoke old key.

Rate limits

Each store can use 40 request units every 60 seconds. Reads cost 1 unit; creating, updating, or deleting costs 2. Every response carries X-RateLimit-Limit, X-RateLimit-Remaining, and X-RateLimit-Reset (the Unix time the current window ends). Requests over the limit get a 429 Too Many Requests response with a Retry-After header giving the seconds to wait.

What the API covers

The reference documents every action in full. Broadly, API v2 covers:

Area	Typical use
Orders	Look up an order’s downloads, resend the download email, reset download limits, attach or detach files
Files and digital products	Upload, update, replace, and delete files, and attach them to products
Licence keys	Add, import, assign, and remove licence keys, and check a key
Customers	Look up a customer and the orders Filemonk delivered to them
Logs and emails	Read download logs and email delivery
Settings	Read and change your Filemonk settings
Imports and exports	Start a CSV bulk import and check which rows failed, or have a CSV export of orders, files, digital products or licence keys emailed to you
Analytics	Read the orders delivered and files downloaded counters from Home

Many deletes are permanent, and sends and fulfilments reach real customers, so test changes on a test order first.

Checking a licence key’s status uses a separate endpoint that does not need this API key. See Check licence key status.

Common tasks

These are the requests an assistant makes for the things merchants ask most:

Task	What to call
Set up download emails	GET /settings and check email.enabled, then GET /digital_products and check every product has files (files_count). Turn email on with PATCH /settings {"email": {"enabled": true}}.
Why didn’t my customer get their file?	GET /emails?order_id=... and read each email’s status (bounced, rejected or complained means the address failed), then GET /orders/:id for its access, then GET /download_logs?order_id=....
How many licence keys are left?	GET /licence_tags and read totals.pending. Each tag shows its own licences.pending.
Revoke an order	PATCH /orders/:id with {"access": {"revoked": true}}. Send false to restore it.
Change the download limit	PATCH /settings with {"download_limits": {"per_file_count": 3, "days": 30}}. null means unlimited; show only decides whether the download page displays the limits.
Connect an AI assistant	Copy the MCP server URL from Settings > Other > AI connectors and add it as a custom connector in Claude or ChatGPT. Signing in asks for your store, then you click Connect in Filemonk in your Shopify admin. See Connect Claude or ChatGPT to Filemonk.

Check your setup

Make a simple read request with your key and confirm you get data rather than an authentication error. If it fails, the error says whether the key expired or was revoked; otherwise the key is wrong, the header name is not X-Auth-Token, or the request went to a different Filemonk address than the one the key came from.

Troubleshooting

Requests are rejected as unauthenticated

Read the error message: it says whether the key expired, was revoked, or was not recognised. Check the header name and that the key was copied whole. An expired or revoked key needs replacing with a new one.

My integration broke suddenly

The key probably expired or was revoked. Look it up in Settings → Other → API: the list shows each key’s status and expiry. Create or rotate a key and update your integration.

I lost the key right after creating it

The full key is shown only once and Filemonk keeps no copy. Revoke that key and create a new one.

Autogenerated licence keys don't validate

Your software has to check them through the licence status endpoint, since they are created by Filemonk rather than your licensing system. See Assign licence keys to a product.

FAQ

How many keys can a store have?

Up to 10 working keys at once. Every key has full access to the store’s Filemonk data; there are no per-user or scoped keys yet.

Can I use it from a browser or a storefront?

No. Anything client-side exposes the key to your customers. Call the API from your server.

Where is the full endpoint reference?

For API v2 (beta), at docs.filemonk.io/v2/introduction, with the raw OpenAPI file at https://app.filemonk.io/api/v2/external/openapi.json. For API v1, at docs.filemonk.io. Both references are linked under API reference, below your key, as API v1 reference and API v2 reference (beta). See Where the documentation is.

How often do I have to replace a key?

When it expires: 30 to 365 days after you create it, whichever you chose. We remind you by email 14 and 3 days before, and Rotate replaces it with a 7-day overlap.

Related guides

• Check licence key status, for verifying keys from your own software.
• Assign licence keys to a product, for autogenerated keys.
• Manage your files, for the same work in the app.
• Connect Claude or ChatGPT to Filemonk, to use an AI app without your API key.