Build on SellersCommerce

A REST API for your store's orders, shoppers, products, categories and returns. Requests and responses are JSON over HTTPS, and every call is authenticated and scoped to your store.

This API is for SellersCommerce retail stores and group stores. A group store's parent can also read its child stores' orders by passing providerId.

Get a token

Base URL Auth OAuth 2 bearer Token life 60 min Rate limit 120 / min · 3000 / hour per endpoint

Quick start

Three steps from credentials to your first response.

Get credentials

Your store admin issues an Access Key and Shared Secret for your integration. Keep them on your server, and never in browser or mobile code.

Request a token

Post the key and secret to /token. You get a bearer token that is valid for 60 minutes, plus a refresh token.

Call the API

Send Authorization: Bearer <token> with every request. Responses are wrapped in a standard envelope.

Authentication

OAuth 2 resource-owner grant. The token is bound to the store that owns the credentials.

Response: { "access_token": "…", "token_type": "bearer", "expires_in": 3599, "refresh_token": "…" }. To renew the token without re-sending the secret, post grant_type=refresh_token&refresh_token=… to the same URL. Refresh tokens are valid for 4 hours and work only once.

Failed sign-ins are counted. Repeated failures, or repeated 401/403/404 responses, block the calling IP for an hour. Cache your token and reuse it until it expires.

Rate limits & security

Limits apply per store and per endpoint, and every response is scoped to the store in your token.

Window	Limit	When exceeded
Per minute	120 requests per endpoint	429 with a `Retry-After` header in seconds
Per hour	3000 requests per endpoint	429 until the next hour
Abuse protection	Repeated failed sign-ins or refused requests from one IP	403 for that IP for 60 minutes

The response envelope reports throttling as StatusCode 429. Back off for Retry-After seconds, then retry.

Only HTTPS. Never send credentials over plain HTTP.
A token reads and writes only its own store's data. A group-store parent may also pass providerId for one of its child stores.
Asking for another store's data returns 403.
Keep the Shared Secret server-side. If it leaks, ask your store admin to rotate it straight away.
Tokens are opaque, so don't parse them. Treat a 401 as "get a new token".

Response envelope

Every response has the same shape. Check StatusCode in the body as well as the HTTP status.

Field	Type	Description
`Results`	object · array · null	The requested data, or the status name of a write operation (for example `Processed`).
`ResponseMessage`	string	Human-readable outcome. Don't parse it; use `StatusCode`.
`StatusCode`	int	SellersCommerce status code. See Status codes.

List endpoints marked OData accept $filter, $orderby, $top, $skip and $select.

Status codes

HTTP status, and the StatusCode value returned in the envelope.

Enums & reference values

IDs and names accepted or returned by the endpoints.