Create API Key
POST/api/portal/api-keys
Creates a named API key with the chosen scopes and returns it.
This endpoint currently requires session authentication; Personal Access Token scope support is in progress.
This is the only response that contains the key (plaintext). Copy it now — it cannot be retrieved later. When the key carries feed:read, ready-made csv_url and json_url inventory feed links are included as well.
Body
name(string, required, max 120 characters) — what the key is for, e.g. "Shopify order sync".scopes(array of strings, required, at least one, no duplicates) — any offeed:read,dropship:read,dropship:write.
Errors (422)
- Missing name, no scopes, or an unknown scope — standard validation errors.
- A dropship scope on an account where dropship is not turned on —
errors.scopes. - The buyer already holds 10 named keys for this account —
errors.name(revoke one first).
Viewers (read-only role) get 403 viewer_read_only. Rate limited to 10 requests/minute.
Request
Responses
- 201
- 401
- 403
- 422
- 429
Created
Response Headers
Unauthenticated — the bearer token is missing, revoked, expired, or malformed. Never retry automatically; fix the credential. See the Errors guide.
Forbidden — the token lacks a required scope, the endpoint is not available to API tokens, or the user behind the token lacks the permission. A human must adjust the token scopes or user permissions; do not retry.
Unprocessable Entity
Response Headers
Rate limited — platform limit is 1,000 requests/min; individual tokens may carry lower limits. Honor the Retry-After header before retrying. See the Rate Limits guide.