Merchant API Keys and Stock Integration (Pro+)
Use owner-created server-side keys for three supported API routes, with scoped access and store usage budgets.
On this page
Create a scoped key
As store owner, open Manage store → Enterprise → Merchant API. Name the key and select only products:read, orders:read or stock:write as needed. Copy the secret once into a trusted server secret store; it is not shown again.
Read the API contract
The public OpenAPI file is /openapi/merchant-v1.json. Supported routes list products, list orders and update non-key stock. Use Bearer authorization, bounded cursor pages and Idempotency-Key for stock writes. It is not a full checkout, refund or customer-provisioning API.
Respect budgets and expiry
Keys created by the console expire after 90 days. Limits are 60 requests/minute per store and 10,000/month on Pro or 100,000 on Enterprise; retries count. Handle 401/403/409/429 responses and revoke unused keys. Owner transfer, suspension or plan loss can stop access.