Authentication

The API uses OAuth2 bearer tokens.

1. Combine your client ID and secret as client_id:secret and encode the result in base64.
2. Call POST /api/oauth/v1/retailer/token with that value in an Authorization: Basic <base64> header. You do not need a username or a password.
3. Send the access_token from the response on every other request, in an Authorization: Bearer <access_token> header.
4. The token expires after expires_in seconds. Request a new one with the refresh_token (grant type refresh_token), or simply request a new token as in step 2.

A missing, invalid or expired token is answered with 401.

The token is linked to your partner account. All product endpoints only show and change your own products; you never have to send your partner code yourself.