Authorization

Every request carries an API key in the Authorization header:

A key belongs to one store. Only the store owner can create or revoke it, from Settings → API keys.

It works on the Dashboard API only and is refused everywhere else.

It never manages keys, team members or sign-ins — even with every ability.

It can expire after 30 days, 90 days or a year, or never. Revoking it stops it at once.

An endpoint marked "API key: not allowed" works only for a signed-in user.

Abilities

A key does only what its abilities allow. A request that needs an ability the key does not hold gets 403.

Ability	Lets the key
`products:read` · `:write` · `:delete`	list, add, edit and delete products
`orders:read` · `:write` · `:delete`	list orders, edit them, change their status
`customers:read` · `:write`	list and edit customers
`topics:read` · `:write` · `:delete`	pages, categories and other content
`shipping:read` · `:write`	shipping companies, zones and prices
`settings:read` · `:write`	store settings
`media:write` · `:delete`	upload and delete files and images
`wallet:read` · `:write`	wallet balance and transactions
`whatsapp:read` · `:write`	WhatsApp messages
`support:read` · `:write`	support conversations

Give each app the fewest abilities it needs: a shipping system needs orders:read and orders:write, nothing else.