What access tokens are for
Access tokens let your own scripts and third-party integrations talk to the Storeep API on behalf of your store. Each token carries a fixed set of permissions, an optional data window, and an optional expiry date. Tokens are safer than sharing your dashboard login because you scope each one to exactly what an integration needs and revoke it on its own at any time.
To manage tokens, go to Settings, Access tokens. The View documentation button opens the full API reference in a new tab.
Token limits
- You can keep up to 40 access tokens per store. Once you reach 40, the Create new token button disappears until you delete one.
- Tokens are listed newest first, 20 per page.
Creating a token
Click Create new token, fill in the form, then click Create.
Token name
- Required, up to 50 characters.
- Used only to identify the token in your list. It is never sent to third parties.
Permissions
Pick at least one of the four scopes. Each is independent, and the API rejects any request whose scope you did not grant (a 403 "insufficient permissions" response naming the scope it needs):
- Read products: access product listings, details, variants, and inventory data.
- Read orders: access order history, details, statuses, and line items.
- Read webhooks: list and view your webhook configurations.
- Manage webhooks: create, update, and delete webhooks.
If you select nothing, creation fails with "Please select at least one permission". Webhooks themselves are set up under Settings, Webhooks; these scopes only control API access to them.
Data access
This controls how far back in time the token may read your data. Pick the most restrictive option that still works.
- Last 24 hours (default): the token only sees data from a rolling 24-hour window, recalculated on every request. Most secure, ideal for real-time feeds.
- Set start date: the token only sees data created on or after a calendar date you pick. Choosing this reveals a Data access start date picker.
- All time: no date restriction, the token reads all history. Use only when an integration genuinely needs it.
Expiration
- Never expires (default): valid until you delete it.
- Set expiration date: reveals an Expiration date picker. The date must be at least one day ahead and no more than one year from today. After it passes, the token stops working automatically and any API call returns "access token has expired".
The token value (shown once)
After you click Create, the token value (a UUID) appears one time in the success message. Copy and store it somewhere safe right away. Storeep never shows it again and cannot recover it. If you lose it, delete the token and create a new one.
Using a token with the API
- Send the value in an HTTP header as Authorization: Bearer YOUR_TOKEN. A missing or malformed header returns a 401 error.
- Each token is rate limited to 60 requests per 60 seconds. Going over returns a 429 "rate limit exceeded" response, so back off and retry after the window resets.
- List endpoints accept a market filter (one country code or up to 20), plus limit (1 to 50, default 20), page (default 1), and sorting by created_at or updated_at. See View documentation for endpoint URLs and full details.
Editing a token
Click any token row to edit its name, permissions, data access mode, and expiration. You cannot view or change the token value itself, editing only updates the settings attached to the existing token, so integrations keep working without a new value.
The tokens list columns
- Name: the label you gave it, with the creation date and time below.
- Permissions: the granted scopes (or None).
- Data access: shows Last 24 hours, All data, or From [date].
- Expiration: the expiry date, or Never.
- Last used: the date and time of the token's last authenticated API call, or Never.
Deleting a token
Select one or more tokens and click Delete tokens, or use the per-row delete action. Deletion is immediate and final: any integration still using that value starts getting 401 authentication errors right away.
Security tips
- Grant only the scopes an integration truly needs.
- Keep Last 24 hours data access for live feeds, and use Set start date for scheduled syncs.
- Set an expiration date for short-term contractors or one-off jobs.
- Watch the Last used column: a token that is Never used or long idle likely belongs to a dead integration and is safe to delete.