Authentication

1Create an API key

You need an API key to connect your application to the store. In the admin panel, choose its permissions to specify which data the application can read and what it can change in the store.

You can also specify the IP addresses your application will use to connect to the API. If you provide them, the key can only be used from those addresses. Then create the API key.

2Get an access token

An access token lets you send requests without including your API key in every request. You can revoke the token when you no longer need it.

The token comes with the permissions and API rate limits available in your store.

curl --disable --globoff --fail-with-body --silent --show-error \
  --proto '=https' --connect-timeout 5 --max-time 30 \
  --request POST \
  --url https://shop.onshopently.com/api/v1/auth/token \
  --header 'Authorization: ApiKey EXAMPLE_API_KEY' \
  --header 'Content-Type: application/json' \
  --data-raw '{"ttl_seconds":1800}'

{
  "data": {
    "access_token": "EXAMPLE_ACCESS_TOKEN",
    "expires_at": "2026-01-01T12:15:00Z",
    "expires_in": 1800,
    "permissions": [
      "orders.order:read"
    ],
    "rate_limits": {
      "auth_per_minute": 1,
      "read_per_minute": 2,
      "write_per_minute": 15
    },
    "token_type": "Bearer",
    "warnings": []
  },
  "meta": {
    "request_id": "example"
  }
}

3Send API requests

Use the token you received when sending API requests. Stay within your store’s rate limits. Access to each operation also depends on the permissions included in your plan.

If you need to choose a language or market for your requests, fetch the store context. You’ll receive the available languages and markets along with their codes and identifiers.

4Revoke the token

Revoking a token is optional. If you use it for a single task, we recommend revoking it when the work is complete. Unless you revoke it manually, the token will remain valid until its set lifetime ends, after which it can no longer be used.

curl --disable --globoff --fail-with-body --silent --show-error \
  --proto '=https' --connect-timeout 5 --max-time 30 \
  --request POST \
  --url https://shop.onshopently.com/api/v1/auth/revoke \
  --header 'Authorization: ApiKey EXAMPLE_API_KEY' \
  --header 'Content-Type: application/json' \
  --data-raw '{"access_token":"EXAMPLE_ACCESS_TOKEN"}'

{
  "data": {
    "revoked": true
  },
  "meta": {
    "request_id": "example-request"
  }
}