Authentication

Send a bearer token in the Authorization header on every call:

GET /api/v1/catalog/items HTTP/1.1
Host: app.stockshift.io
Authorization: Bearer 7|Zc1q...
Accept: application/json

A few endpoints, such as the mobile apps’ sign in, take no token, and their entries in the API reference say so. There are two kinds of token. The API treats them the same once they arrive.

Token	For	Where it comes from
API key	Your own scripts and server-to-server integrations	A member creates it in the app
OAuth access token	Apps that other people connect to their StockShift account	Your app runs the OAuth flow

API keys

Settings > Access > API keys lists the organization’s keys with their name, owner, scopes, when they were created, when they expire and when they were last used. To create one, press New API key, give it a name, pick an expiry date (or none) and tick the scopes it needs. Copy the key when it is shown, because it is never shown again. Keys that expire are safer. A key belongs to the member who made it and to the organization it was made in:

It can never do more than that member can. Each call needs both the member’s permission and one of the key’s scopes. See Permissions and scopes.
It cannot reach any other organization.
If the member leaves the organization, the key stops working.

Press Revoke to stop a key at once. Anything using it gets 401 from then on, and the key stays in the list marked as revoked.

When a token fails

Status	`code`	Why
`401`	`unauthenticated`	No token, or one that has expired or been revoked.
`403`	`forbidden`	The member lacks the permission or the token lacks the scope.

Keep keys out of source control and client-side code. Load them from your secret store or environment, as the examples here do with STOCKSHIFT_TOKEN.

Get started

Using the API

Events and apps

API keys

When a token fails

​API keys

​When a token fails

API keys

When a token fails