Skip to main content
Two checks run on every call, and both have to pass:
  1. The member behind the token needs the permission, such as catalog.items.create. Permissions come from the member’s role in the organization.
  2. The token needs the scope, such as catalog:write. Scopes are chosen when the key is created or when a member approves an OAuth app.
A key with catalog:write still cannot create items if its owner’s role does not allow it, and an owner’s key limited to inventory:read cannot post adjustments. Either failure answers 403 with the code forbidden. Each endpoint in the API reference lists the permission and scope it needs.

​
Scopes

Scopes come in a read and write pair for each area of the app. Read covers anything that only looks. Write covers anything that changes something. An API key can also hold *, which is every scope; an OAuth app cannot. Give a key only the scopes its job needs. A key that feeds a stock dashboard needs inventory:read and nothing else.

​
Plan limits

Some features depend on the organization’s plan. A call to one the plan does not include answers 403 with the code plan_upgrade_required, and feature names what is missing. Nothing is written.