Skip to main content

In-app parameters overview

In-app parameters are values you configure in the APIEase admin to be injected into outgoing requests. They live on the server, so secrets and default values stay hidden from storefront visitors while still being applied every time a request runs.

Why use in-app parameters

  • Keep secrets safe: tokens, API keys, and internal headers stay server-side.
  • Ensure consistency: apply the same defaults (such as content type or store identifier) across every request.
  • Reduce duplication: define values once instead of repeating them in multiple requests or client code.

Parameter types

  • Headers for auth and custom metadata.
  • Body for payload fields you manage centrally.
  • Path for URL segments that should not be exposed on the storefront.
  • Query for reusable query strings.
  • System auto-populated by APIEase for common Shopify context.
  • Flow to map Shopify Flow tokens into your requests.

How to add

  1. Open a request in the APIEase admin and click the plus icon in the Parameter column.
  2. Choose the parameter location (Header, Body, Path, or Query), then enter the name and value. Turn on Sensitive for a credential or other confidential value.
  3. Save the request. APIEase will inject these values whenever the request is executed.

After you save a sensitive request parameter, APIEase masks it and does not return its value through normal read interfaces. It decrypts the value only when executing the request. If you lose the original value, obtain or generate a replacement at its issuing provider and replace the saved value; APIEase cannot reveal it.

When to combine with dynamic parameters Use in-app parameters for anything sensitive or static. If you need runtime data from the storefront (such as cart info, page context, or user input), pair them with dynamic embedded parameters. Keep credentials and other confidential values in-app and server-side.

Sensitive parameter storage protects the saved request configuration. It does not remove private data from the external API's response. Do not make a request publicly callable if its response can contain credentials or other private data.