Authentication
External apps authenticate with an OAuth 2.0 access token or a store-scoped API key. Send Authorization: Bearer … on every /api/v1 request.
- OAuth access tokens start with
eta_ - API keys start with
etsk_live_
The token is bound to one store at authorize time. Never send storeId as a client parameter — the API ignores it and uses the grant.
Errors
{ "error": { "code": "INSUFFICIENT_SCOPE", "message": "…" } }