Skip to main content
POST
Issue this merchant's Direct API credential

Authorizations

Authorization
string
header
required

Short-lived random access credential backed by current server-side session state.

Body

application/json
scopes
enum<string>[]
required

What the merchant grants the credential it issues for itself. A self-issued credential must never out-rank its issuer, so the Direct API surface is all that is on offer.

Required array length: 1 - 8 elements
Available options:
shipments:read,
shipments:write,
webhooks:manage
purpose
string | null
Maximum string length: 120

Response

Credential issued. The secret is disclosed here and never again.

The one and only disclosure of a secret. What is stored is a peppered digest, so this value cannot be produced again and a lost secret is rotated rather than looked up.

merchantId
string<uuid>
required
clientId
string
required
Maximum string length: 64
clientSecret
string
required
Maximum string length: 128
version
integer<int64>
required
Required range: x >= 0