Skip to content
ExtensionsStorefronts

Authentication

Developer dashboard login and request credentials serve different purposes.

  • Developer account login signs a developer into the dashboard to manage callback settings, API keys, project connections, and webhook destinations.
  • API keys authorize Extension or Storefront requests through saved project connections.

Extension and Storefront requests must use Authorization: Bearer YOUR_API_KEY. Do not send a developer dashboard session token to public endpoints.

Authentication Flow

  1. Create a developer account from the documentation header.
  2. Log in to the developer dashboard.
  3. Register the developer account callback URL.
  4. Generate a global API key.
  5. Create a connection request with a random state value.
  6. Send the user to the returned ModuSell connection URL.
  7. The user logs in, chooses a project, and approves access.
  8. Receive a one-time authorization code at the registered redirect URL.
  9. Verify state, then complete the connection with the code and the same API key.
  10. Send that API key when requesting data for the connected project.

Developer account + callback URL -> Global API key -> Connection URL -> ModuSell login -> Project selection -> Saved connection

Credential Boundaries

  • Dashboard sessions authorize only private developer-dashboard actions.
  • API keys belong to the developer account and are not assigned to one integration or project.
  • Each approved project is stored as a separate connection under the API key, so one key can connect to multiple projects.
  • Connected-project requests use Authorization: Bearer YOUR_API_KEY; no additional reusable project credential is issued.
  • API keys are stored as one-way hashes. Raw keys are returned only when created or rotated.

Project Ownership

  • A project created through an API key treats that API key as the API owner for project-level destructive actions.
  • The ModuSell user who owns the project can still delete that project from their ModuSell account.
  • Other API keys cannot delete a project just because they have a connection to it.
  • A project created directly by a ModuSell user is user-owned. Connected API keys can request authorized endpoints, but they cannot delete the project itself.

Never send a developer dashboard session token to a public API operation.