Skip to main content
OmniCommerce developer endpoints authenticate with bearer tokens. Prefer organization API keys for server-to-server integrations. Create a key in organization settings. Send it as:
API keys are organization-scoped. Do not send organizationId for API-key requests. Session-authenticated UI calls still require organizationId.
API keys created from organization settings receive all developer scopes by default.

​
OAuth client credentials

Machine clients can use:
and revoke with:
Request only the scopes your client needs. Common scopes include: Exact scope requirements are listed on each endpoint in the API reference and in the guides.

​
Session auth (first-party UI)

Browser sessions (cookies) work for first-party OmniCommerce UI flows. Those requests must include organizationId in the query string (GET) or JSON/multipart body (writes).

​
Playground

The Mintlify API playground uses bearer auth. Paste your omni_sk_... key when using Try it. Prefer non-production keys when testing.

​
Error responses

Unauthenticated or under-scoped requests return 401 / 403 with a JSON error body. Retry only after fixing credentials or scopes—do not spin on auth failures.