Set up developer API access

If you build or connect an external application to your online shop — a mobile app, an integration, or a custom storefront — it needs credentials to call the Shop API. Vinosoft lets you mint access tokens and register OAuth clients from Shop → Configuration → API.

Access tokens

Access tokens are the simplest way to authenticate a script, backend service, or integration against the Shop API.

Go to Shop → Configuration → API and, under Access tokens, click Create token.

1. Enter a Label describing what the token is for (e.g. "Mobile app integration").
2. Choose the Token type:
3. • Admin — full Shop API access, scoped to whichever Shop module permissions you select.
   • Storefront — public read access only, for capabilities like reading products, collections, or content, and writing checkouts.
3. Select the specific Scopes the token should be limited to.
4. Click Create.

The full token value is shown once, immediately after creation. Copy it into your application's configuration right away — Vinosoft only stores the token's prefix afterward and cannot show you the full value again.

Each token in the list shows its prefix, label, scopes, creation date, and last-used date, so you can tell tokens apart and spot ones that are no longer in use. To revoke a token, use the Revoke action on its row — this immediately stops any application using it from authenticating.

Customer Account OAuth clients

If you're building a customer-facing app that lets shoppers sign in with their Vinosoft shop account, register an OAuth client instead of an access token. These are public PKCE clients — no client secret is issued or stored.

Under Customer Account OAuth clients, click Register client:

1. Enter a Display name for the application.
2. Enter one or more Redirect URIs (one per line) that the OAuth flow is allowed to send shoppers back to.
3. Select the Scopes the client can request, such as reading the shopper's own data, reading orders, or writing addresses.
4. Optionally enable Allow password grant if your application needs it.
5. Click Register.

After registration, Vinosoft shows the generated Client ID — copy it into your application. Since no secret is issued, keep the client ID paired with your registered redirect URIs and PKCE flow for security.

Each registered client shows its name, scopes, redirect URIs, password grant setting, and status. Use the Disable action on a client's row to stop it from authenticating shoppers — for example, if an app is retired or you suspect its configuration was compromised.

Related: Configuration, Set up shop integrations.