Authentication

Note: The public REST API is in private preview as of v0.4 (May 2026). This page documents the intended shape; concrete endpoints land in v0.5.

Token types

Issuing tokens

• Developer token: Generate from your developer dashboard. Lasts 1 year, rotatable.
• Tenant token: Each tenant owner generates one from /admin/api-tokens (Coming Soon). They give it to you for one-tenant integrations.
• OAuth tokens: Auto-issued at install. Expire after 30 days; refresh via standard OAuth 2.0 refresh-token flow.

Sending the token

GET /api/v1/orders HTTP/1.1
Host: shop.eyalla.com
Authorization: Bearer eyalla_token_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
Accept: application/json

Send as Authorization: Bearer .... We don't accept tokens via query string — too easy to leak into server logs.

Rate limits

Exceeding returns 429 with Retry-After header in seconds. Hits don't carry over.

Scopes

When OAuth ships, request only the minimum scopes you need. Tenants will deny apps that ask for write_* when they only need read_*.

Available scopes (planned):

• read_orders / write_orders
• read_products / write_products
• read_customers / write_customers
• read_inventory / write_inventory
• read_analytics (reports)
• manage_webhooks

Errors

{
  "error": {
    "code": "invalid_token",
    "message": "Token has been revoked.",
    "documentation_url": "https://developers.eyalla.net/errors/invalid_token"
  }
}