Account

What this key is and what it reaches.

Part of the API reference, version 2026-10. Every address below starts with the base address:

https://app.matrixrewards.co.uk/api/2026-10

The account this key belongs to, its stores, and the key's own scopes

GET /me — the full address is https://app.matrixrewards.co.uk/api/2026-10/me.

Needs: any valid key; no permission needed.

Needs no scope beyond a valid key: a client's first call should not have to guess what it may do.

The answer

The account, its stores and this key.

Headers on the answer: Request-Id, X-RateLimit-Limit, X-RateLimit-Remaining, X-RateLimit-Reset. What each header means.

Example

curl "https://app.matrixrewards.co.uk/api/2026-10/me" \
  -H "Authorization: Bearer $MATRIX_API_KEY"

The answer:

{
  "api_version": "2026-10",
  "account": {
    "id": "acc_example",
    "name": "Example Retail Ltd",
    "wallet_scope": "site",
    "created_at": "2026-08-03T09:12:00Z"
  },
  "stores": [
    {
      "key": "example-outlet",
      "name": "Example Outlet",
      "platform": "shopify",
      "external_ref": "example-outlet.myshopify.com",
      "created_at": "2026-08-20T14:30:00Z",
      "display_name": "Example Outlet"
    },
    {
      "key": "example-store",
      "name": "Example Store",
      "platform": "shopify",
      "external_ref": "example-store.myshopify.com",
      "created_at": "2026-08-03T09:12:00Z",
      "display_name": "Example Store"
    }
  ],
  "key": {
    "id": "Kx7Qp2Lm9Vt4Rz8N",
    "name": "Nightly export",
    "mode": "live",
    "scopes": [
      "manage_keys",
      "read_audit",
      "read_members",
      "read_programme",
      "read_reports",
      "read_usage",
      "write_members",
      "write_webhooks"
    ],
    "agent": false,
    "limits_lifted": false,
    "used_previous_secret": false
  },
  "rate_limit": {
    "limit": 120,
    "remaining": 119,
    "reset": 1789552801
  }
}

Other answers

The API keys on this account

GET /keys — the full address is https://app.matrixrewards.co.uk/api/2026-10/keys.

Needs: the manage_keys permission (in the app: “The list of your keys (not their secrets)”).

Never the secret half: the row keeps a keyed hash of it. A key whose plaintext was lost is rotated, not recovered. Keys are created, rotated and revoked in the app's API keys screen, behind a Shopify staff session — no scope mints a key, because a key that could mint keys could widen its own reach.

The answer

The keys.

Headers on the answer: Request-Id, X-RateLimit-Limit, X-RateLimit-Remaining, X-RateLimit-Reset. What each header means.

Example

curl "https://app.matrixrewards.co.uk/api/2026-10/keys" \
  -H "Authorization: Bearer $MATRIX_API_KEY"

The answer:

{
  "data": [
    {
      "id": "Kx7Qp2Lm9Vt4Rz8N",
      "name": "Nightly export",
      "mode": "live",
      "scopes": [
        "manage_keys",
        "read_audit",
        "read_members",
        "read_programme",
        "read_reports",
        "read_usage",
        "write_members",
        "write_webhooks"
      ],
      "agent": false,
      "limits_lifted": false,
      "created_at": "2026-09-01T08:00:00Z",
      "last_used_at": "2026-09-16T10:00:00Z",
      "revoked_at": null,
      "rotation_grace_until": null
    }
  ],
  "has_more": false,
  "next_cursor": null
}

Other answers

Stop the key making this request, immediately

POST /keys/self/revoke — the full address is https://app.matrixrewards.co.uk/api/2026-10/keys/self/revoke.

Needs: any valid key; no permission needed.

Needs no scope: presenting the key is the authorisation. It takes no identifier, so it cannot revoke any key but the one signing the request — which is what makes it safe to leave unscoped. Use it the moment a key is believed to have leaked; a merchant can also revoke any key from the app's API keys screen. The revoke and its audit entry are one transaction, and so is deleting every webhook endpoint the key created (webhook.delete for each, with the reason and the key's id).

The answer

The key is revoked. It will not authenticate again.

Headers on the answer: Request-Id. What each header means.

Example

curl -X POST "https://app.matrixrewards.co.uk/api/2026-10/keys/self/revoke" \
  -H "Authorization: Bearer $MATRIX_API_KEY"

The answer:

{
  "ok": true,
  "key_id": "3D1wN9KfD8595Al5",
  "revoked_at": "2026-09-16T10:00:00Z"
}

Other answers