Skip to main content
Every call to the API carries a token in the Authorization header:

​
Create a token

In Settings → API tokens → New token (editor or owner role). The token is shown once only. Details in API tokens and webhooks.

​
What it may do

A read-only token that tries to write gets 403.

​
Which team it works for

A token works for the team it was created in, and for that team only. It sees nothing of its owner’s other teams, even when they switch team in the browser. It also acts with its owner’s rights in that team, checked on every call:
  • if the owner becomes a viewer, writes answer 403;
  • if they leave the team, every call answers 403;
  • if the team is suspended, every call answers 403 with a message that says so.
For a lasting integration, create tokens from a service account (say api@myshop.example, editor role) rather than from the account of someone who may leave the team.

​
Good habits

  • One token per application. You will know which one to revoke.
  • The least you need. A dashboard that reads statistics only needs Read.
  • Server side only. A token in browser JavaScript or in a mobile application is public. To subscribe from a browser, use the form, which needs no token.
  • In a vault. An environment variable or a secret manager, never in the repository.
  • Revoke at the first doubt: Settings → API tokens → Revoke cuts access immediately. The Last used column helps spot a forgotten token.

​
Authentication answers