WebStore Developer API

Connect catalog, stock, order and operational systems through tenant-scoped clients, short-lived tokens and idempotent events.

Developer sign in View API reference

1. Receive a developer login

A business owner grants tenant access and selects the capabilities you may request.

2. Create an API client

Create a test or live client and store the one-time secret in your own secret manager.

3. Request a short-lived token

Use OAuth client credentials. Rotate or revoke the client without changing a business login.

Authentication model

Client secrets are shown once and stored only as a one-way hash.

Access tokens expire after 15 minutes and contain a fixed scope subset.

Secret rotation invalidates every older access token immediately.

Paused clients, kill switches and inactive modules stop API traffic.

OpenAPI 3.1 JSON Postman collection

Quick start

curl --request POST \
  "$BASE_URL/api/developer/oauth/token" \
  --user "$CLIENT_ID:$CLIENT_SECRET" \
  --header "Content-Type: application/x-www-form-urlencoded" \
  --data-urlencode "grant_type=client_credentials" \
  --data-urlencode "scope=products.read orders.handoff"

API reference

Every operation is tenant-scoped, rate-limited and returned as JSON with no-store response headers.

POST

POST /api/developer/oauth/token

Request access token

Exchange a client ID and client secret for a tenant-bound token that expires after 15 minutes.

Client credentials

GET

GET /api/developer/v1/me

Inspect client identity

Confirm the active tenant, client version, environment and effective scope set.

Any granted scope

GET

GET /api/integrations/{clientId}/events

Poll outbound events

Read at most 100 pending events filtered to the scopes inside the access token.

Matching read or handoff scope

POST

POST /api/integrations/{clientId}/events

Publish or acknowledge an event

Publish an idempotent inbound projection or acknowledge a previously offered outbound event.

Matching write or decision scope

curl --request POST \ "$BASE_URL/api/developer/oauth/token" \ --user "$CLIENT_ID:$CLIENT_SECRET" \ --header "Content-Type: application/x-www-form-urlencoded" \ --data-urlencode "grant_type=client_credentials" \ --data-urlencode "scope=products.read orders.handoff"