Publishable Keys

A publishable key starts with pk_. You can put it in a web page, for example in a barcode scanner on your website. A secret API token must stay on your server. A publishable key is safe in the browser because of these limits:

• It can only call the barcode lookup routes.
• It only works from the domains that you allow.
• It has its own rate limits, and an optional daily cap.

Lookups with a publishable key use the API calls of your plan, like lookups with an API token.

Create a key

1. Sign in and open Tokens in the dashboard.
2. In Publishable Keys, create a key. Give it a name (3 to 32 characters).
3. Add the allowed domains, one per line.
4. Set the rate limits. Then copy the key.

You need an active plan or the free trial to create a publishable key. Each account can have up to 5 publishable keys.

Routes

A publishable key works on these routes only:

/api/v2/barcode/lookup/{barcode}
/api/v2/barcode/lookup/sku/{style_code}
/api/barcode/lookup/{barcode}
/api/barcode/lookup/sku/{style_code}

The last two are the V1 routes. Any other route answers 403.

The key holds lookup-barcode, lookup-barcode-sku, or both. It can only hold an ability that your plan has. See GET Lookup Barcode and GET Lookup Barcodes by SKU for the parameters and the answers.

Header

Authorization: Bearer pk_...

Allowed domains

The browser sends the Origin header (or the Referer header) with each request. Barcodes.GG checks it against the allowed domains of the key. A request without one of these headers answers 403. A publishable key does not work from a server or a script.

• Add up to 20 domains to a key.
• Without a scheme, https is used. localhost and 127.x.x.x use http.
• Without a port, only the default port of the scheme matches. Add the port for local work, for example localhost:5173.
• *.shop.com allows every subdomain of shop.com, but not shop.com itself. Add both when you need both.
• Paths are ignored.

Examples:

shop.com
https://*.shop.com
http://localhost:3000

Rate limits

The daily cap stops a copied key from using all of your API calls. A request over a limit answers 429 with a Retry-After header.

Errors

{
  "error": true,
  "message": "Invalid or expired publishable key."
}

Use it with the scanner library

The @barcodesgg/scanner library scans barcodes with the camera. With a publishable key, it also looks up the product.