Authentication
How do I generate an API token?
Create a personal access token from the Personal access tokens tab of your developer dashboard, then select Generate new token. Only the account owner can create and manage tokens.
When you generate a token, you choose:
- Name — required, and must be unique among your tokens.
- Description — optional, to remind you what the token is for.
- Expiration — 7, 30, 60, or 90 days, a custom date, or no expiration.
- Permissions — the scopes the token can use. Choosing write access to a resource includes read access. See Available Scopes for what each one unlocks.
Copy your token as soon as it's generated. It's shown only once, and you can't view it again after you leave the page.
How do I authorize API requests once I have my API token?
Please include your API token in every request you make using the Bearer token format, using the following header format:
Authorization: Bearer <Your Whatnot Seller API Key>
Personal access tokens use the prefix wn_pat_tk_. Tokens issued to an app through OAuth use the prefix wn_access_tk_.
How do I manage my tokens?
Select a token on the Personal access tokens tab to see when it was created, when it was last used, when it expires, and which permissions it has. From there you can:
- Edit its name, description, expiration, or permissions. Expired tokens can't be edited; regenerate them instead.
- Regenerate it, which creates a new token with the same name, description, and permissions and deletes the current one. Anything using the current token stops working immediately, and the new token is shown only once.
- Delete it. Anything using the token stops working immediately, and this can't be undone.
My token was leaked or compromised! What should I do?
Open the token in your developer dashboard right away. Regenerate it to get a replacement with the same settings, or Delete it if you no longer need it. Either way, the compromised token stops working immediately.
Available Scopes
Your API key is assigned scopes based on the features it needs. For example, a key used to display and update inventory might have read:inventory and write:inventory, while one used to fulfill orders off-platform might have write:orders and read:customers.
The list below is generated from the live API reference, showing exactly which endpoints and fields each scope unlocks.
