Get started

Authentication with private apps

Create an app, get a token, call the API.

API access is given only through apps. A private app belongs to one store and has the scopes you choose.

Create a private app

1. In the admin, open Settings, Develop apps, and create an app.
2. Choose its scopes, for example read_products. Ask only for what the app needs.
3. Copy the access token. It is shown once. Store it on your server, never in a browser or a mobile app.

Live stores issue pat_live_ tokens; development stores issue pat_test_ tokens.

Call the API

curl https://api.storelyne.com/admin/2026-11/shop \
  -H "Authorization: Bearer pat_live_..."

The token already names its store, so you never send a store ID with it.

Scopes

A call outside the app's scopes returns missing_scope (403). Change scopes in Settings, Develop apps; the change applies at once.

Rotate and revoke

Rotating issues a new token and revokes the old one. Uninstalling the app revokes its tokens at once: the next call returns invalid_token (401).