Shopline Authentication

generated: '2026-07-21'
method: searched
source: https://developer.shopline.com/docs/apps/api-instructions-for-use/rest-admin-api/overview
docs: https://developer.shopline.com/docs/apps/api-instructions-for-use/rest-admin-api/overview
summary:
  types: [oauth2, apiKey]
  api_key_in: [header]
  oauth2_flows: [authorizationCode]
  token_transport: "Authorization: Bearer <accessToken> (JWT)"
notes: >-
  SHOPLINE Open Platform gates all API access behind Store Authorization, which
  differs by app distribution method. Custom apps and Public apps use OAuth 2.0
  (authorization-code); Private apps use a long-lived token minted in the store
  admin. Access tokens are JWTs passed in the Authorization header using the
  Bearer scheme. No downloadable OpenAPI/Swagger security scheme was published,
  so this profile is captured from the developer documentation rather than
  derived from a spec.
schemes:
  - name: OAuth2 (Custom and Public apps)
    type: oauth2
    flow: authorizationCode
    grant: authorization_code
    app_credentials: [App Key, App Secret]
    obtained_in: SHOPLINE Developer Center
    callback: >-
      After the merchant grants permissions during OAuth, SHOPLINE redirects to
      the app Callback URL with a temporary OAuth code, which the app exchanges
      for an accessToken.
    access_token:
      format: JWT
      transport: "Authorization: Bearer <accessToken>"
      lifetime: 10 hours
      refresh: Refresh Token interface; original token remains valid 5 minutes after refresh
      revoke: Cancel Authorization interface (token invalidated immediately)
    scopes_model: >-
      The accessToken carries the scopes the app requested at install time
      (read_* / write_* permissions, e.g. read_bulkoperation, write_bulkoperation).
    docs: https://developer.shopline.com/docs/apps/application-management/creating-an-app
  - name: Private app token
    type: apiKey
    in: header
    parameter_name: Authorization
    scheme_note: Bearer JWT minted in the store admin backend
    lifetime: 3 years (email reminder before expiry)
    refresh: Refreshed from within the store admin; original token valid 30 minutes after refresh
    revoke: Delete the app in the store admin (token invalidated)
    limitations: Cannot use App Bridge or App Extensions
    docs: https://developer.shopline.com/docs/apps/application-management/application-distribution-methods
request_headers:
  Authorization: "Bearer <accessToken>"
  Content-Type: "application/json; charset=utf-8"