Authentication

Status: The public REST API is live at https://api.eyalla.net/v1. It is available to stores on the Elite plan; owners generate a key from their store admin (see Issuing tokens).

Tenant API keys and scope enforcement are shipped. OAuth apps and the webhook-subscription dashboard are not yet built — the sections below say so where it applies.

Token types

Issuing tokens

• Tenant API key — this is the one to use today. The store owner generates it in their admin at Settings → API keys (/admin/api-keys), picks the scopes, and copies the key. The key is shown exactly once, immediately after creation; it is stored hashed and cannot be retrieved again. Requires the Elite plan.
• Developer token (not yet available) — a single credential spanning every tenant you integrate with.
• OAuth tokens (not yet available) — install-time authorization for third-party apps.

Do not confuse Settings → API keys (/admin/api-keys, this API) with Bookings → Access API keys (/admin/access-api-keys). The latter mints credentials for gym door-access hardware, a separate API with its own scopes; a key from that page will not authenticate against /v1. That API is documented in Access Control API.

Sending the token

GET /v1/orders HTTP/1.1
Host: api.eyalla.net
Authorization: Bearer <your key>
Accept: application/json

Every request goes to api.eyalla.net — not to the store's own domain. The key identifies which store you are calling, so there is no tenant id or subdomain in the URL.

Send as Authorization: Bearer .... We don't accept tokens via query string — too easy to leak into server logs.

Rate limits

Exceeding returns 429 with Retry-After header in seconds. Hits don't carry over.

Scopes

Every key carries an explicit scope list, chosen by the store owner when they create it. A request outside those scopes is refused with 403 insufficient_scope — enforcement happens before the endpoint runs, so a missing scope never partially applies.

These are the scopes that exist:

Ask for the minimum you need — the owner sees exactly what they are granting, and a key that asks for write access it never uses is one an owner is right to refuse.

⚠️ These names changed. An earlier version of this page listed the form read_orders / write_products, and also listed read_inventory, write_inventory, read_analytics and manage_webhooks. Those names were never implemented: the delimiter is a colon and the resource comes first. If you built against the old list, every request would have failed insufficient_scope. The four extra scopes do not exist in any form yet.

Errors

{
  "error": {
    "code": "invalid_token",
    "message": "Token has been revoked.",
    "documentation_url": "https://developers.eyalla.net/errors/invalid_token"
  }
}