API security & limits

The guardrails around API keys — read-only access, default-deny, account scoping, and the 60-requests-per-minute rate limit.

API keys are designed to be safe to hand to a third-party tool or LLM. Even if a key leaks, the damage it can do is tightly bounded. Here's exactly what protects you.

Read-only by design

Keys can read your data but never change it. There's no way to grant a key write access — placing orders, editing prices, deploying Actions, changing settings, and the like are all off-limits to API keys. A token handed to an outside agent simply cannot mutate your shop.

Default-deny

Access is default-deny: a key can only reach the specific endpoints we've explicitly opened for programmatic use (the curated agent surface). Anything else — including a brand-new endpoint we ship tomorrow — is rejected with a 403 until it's deliberately allowed. Nothing is exposed by accident.

A key can't manage keys

API-key management (creating, listing, or revoking keys) requires an interactive, signed-in session — it can never be done with an API key. So a leaked read-only token can't escalate by minting fresh credentials or quietly revoking your others.

Sensitive surfaces are walled off

Marketplace partner pass-through (raw Shopee / Lazada / TikTok partner calls), account impersonation / sign-in-as, billing actions, and similar high-risk surfaces are explicitly excluded from key access — separately from the read-only rule, as a second layer of defense.

Scoped to your account

A key inherits your account's view and nothing more. It can't see another seller's shops, products, or numbers — every request is evaluated as you.

Rate limit: 60 requests / minute

Each API key is throttled to 60 requests per minute. The limit is a token bucket: up to 60 requests in a burst, then refilling at 1 request per second. Go over and you'll get:

HTTP 429 Too Many Requests
Retry-After: <seconds>

Honor the Retry-After header and pace your calls — well-behaved scripts rarely hit this. The limit is applied per key, so one runaway agent can't starve the rest of your integrations.

Lifecycle

Shown once, hashed at rest — we keep only a SHA-256 hash of the token, never the token itself.
Optional expiry — set a key to expire in 30 / 60 / 90 / 365 days, or never.
Instant revocation — revoking a key blocks it immediately, on the very next request.

Treat a key like a password: don't commit it to a repo, paste it in a shared chat, or email it. If one might be exposed, revoke it from Settings → API keys and issue a new one.

Getting started

Endpoints: products & orders