Authentication

Headers: X-App-Key X-App-Secret X-Shop-Id

Every Kixmon Profit API request is authenticated with an app key and an app secret, sent as HTTP headers. All endpoints except Get Shops are scoped to one shop and also need an X-Shop-Id header. There is no OAuth flow and no token to refresh — the same two credentials work on every request.

Get your API keys

1. Log in to your Kixmon account and connect your TikTok Shop and ads account.
2. In the left sidebar, open Setting → REST APIs and click Enable REST APIs. REST APIs must be available on your current plan — if not, upgrading enables them.
3. Your app key (starts with km_) and app secret are generated there. One pair per account — the same credentials work on all of your shops.
4. Copy the app secret immediately and store it on your server. It is hidden after you leave the page. If you lose it, click Refresh credentials for a new one — existing integrations stop working until you update them.
5. Call Get Shops once to get the id of each shop, and send it as X-Shop-Id on all other endpoints.

Headers

Example

curl 'https://api.kixmon.io/api/v1/shops' \
  -H "X-App-Key: $KIXMON_APP_KEY" \
  -H "X-App-Secret: $KIXMON_APP_SECRET"

const res = await fetch("https://api.kixmon.io/api/v1/shops", {
  headers: {
    "X-App-Key": process.env.KIXMON_APP_KEY,
    "X-App-Secret": process.env.KIXMON_APP_SECRET,
  },
});
const data = await res.json();

import os, requests

resp = requests.get(
    "https://api.kixmon.io/api/v1/shops",
    headers={
        "X-App-Key": os.environ["KIXMON_APP_KEY"],
        "X-App-Secret": os.environ["KIXMON_APP_SECRET"],
    },
    timeout=30,
)
resp.raise_for_status()
data = resp.json()

A successful call returns HTTP 200 with "success": true. To try requests without writing code, use the API Testing Tool — it fills in your credentials and builds the cURL command for you.

Authentication errors

Keeping credentials safe

• Call the API over HTTPS from your server or a trusted automation tool (Zapier, Make, n8n).
• Never put the app key or app secret in website code, a mobile app, or a public repository.
• Store credentials in environment variables or a secrets manager, not in source code.
• If a secret is exposed, regenerate it in Settings immediately — the old one stops working.