There is no self-service API-key page in the admin. Access works like this:

• Customer-scoped calls (profile, cards, cart, subscriptions) use a token: call POST /api/v1/users/login with the customer's username/email and password and send the returned token as Authorization: Bearer <token> on later requests. Calls with no Authorization header get a 401 with {"error":"auth_code"}; calls with an invalid/expired token get a 401 with a different error message.
• Public calls (zip-code check, pickup points, newsletter form, captcha token) need no credentials.
• Sprwt-internal admin endpoints (/api/v1/admin/...) are protected by a deployment key known only to Sprwt and are used for maintenance and billing; they are not for customer use.
• Versions feed uses a dedicated Versions API Key that Sprwt sets for your site.
• Incoming webhooks (Root Planner, Shippo) use their own secrets/keys shown on the respective Integrations cards.

If you are building an integration, contact Sprwt support to confirm the endpoints you need and how they should be authenticated.