Authentication

The API uses OAuth2 client credentials. You exchange a client_id and client_secret for a short-lived access token, then send that token as a Bearer credential on every request.

Client & shop scoping

Access is scoped to a client (your company) and the shop it belongs to. A token only ever grants access to that shop's data — campaigns, orders and webhook subscriptions — so you can never read or act on another client's shop. Call GET /me to see the client and shop a token resolves to.