Authentication models

Request and response models for API authentication. Check the token payload, token lifetime and the fields required to authenticate an integration.

Data schemas

Get an access token — Response

ApiResponse_TokenData_ · Fields, types and constraints of data accepted or returned by the API.

dataTokenData Required: Response example · TokenData.

Example: {"access_token":"EXAMPLE_ACCESS_TOKEN","expires_at":"2026-01-01T12:00:00Z","expires_in":900,"rate_limits":{"auth_per_minute":10,"read_per_minute":60,"write_per_minute":10},"token_type":"Bearer"}
metaContextPageMeta ContextMeta PageMeta RequestMeta Required: Response metadata.

Example: {"request_id":"example"}

Additional fields: No

Get an access token — Response

TokenData · Fields, types and constraints of data accepted or returned by the API.

access_tokenStringRequired: Token for the Authorization: Bearer header. Set SHOPENTLY_ACCESS_TOKEN before running the separate example.

Example: "EXAMPLE_ACCESS_TOKEN"
expires_atStringRequired: Expiration time in UTC. Current access restrictions can block the token earlier.

format: "date-time"

Example: "2026-01-01T12:00:00Z"
expires_inIntegerOptional: 900 seconds, or 15 minutes from issuance. Making requests does not extend its lifetime.

Default: 900Example: 900
rate_limitsTokenRateLimitsData Required: Engine ≥ 4.143.0. Each token response includes data.rate_limits from the store policy at issuance. All keys share these budgets; a new token does not reset them. A plan change may apply before the token expires.

Example: {"auth_per_minute":10,"read_per_minute":60,"write_per_minute":10}
token_typeStringOptional: Bearer. Authentication scheme for the returned token.

const: "Bearer"

Default: "Bearer"Example: "Bearer"

Additional fields: No

Rate limits

TokenRateLimitsData · Engine ≥ 4.143.0. Each token response includes data.rate_limits from the store policy at issuance. All keys share these budgets; a new token does not reset them. A plan change may apply before the token expires. Zero means unavailable, not unlimited.

auth_per_minuteIntegerRequired: Token requests per minute, including failed authentication attempts.

minimum: 0maximum: 1000000

Example: 10
read_per_minuteIntegerRequired: Read requests per minute.

minimum: 0maximum: 1000000

Example: 60
write_per_minuteIntegerRequired: Write requests per minute; this value does not grant write permissions.

minimum: 0maximum: 1000000

Example: 10

Additional fields: No

Get an access token — Request body

TokenRequest · Fields, types and constraints of data accepted or returned by the API.

ObjectAdditional fields: No

Additional fields: No