Get started
Authentication
Send your key in the Authorization header on every request:
Authorization: Bearer gp_live_…There is no other way to send it. The API never accepts a key in a URL, because URLs end up in logs.
Scopes#
Each key has scopes that limit what it can do. GET /v1/me lists them.
| Scope | Lets the key |
|---|---|
catalog:read | Read your products, your competitors and your SKU links |
matches:read | Read comparison sets: competitor matches and prices |
skus:write | Create, replace and remove SKU links |
A key without the scope an endpoint needs gets 403 insufficient_scope. A key created in Settings has all
three scopes.
Keep your key safe#
- Treat the key like a password. Anyone who has it can read your competitor prices.
- Store it in an environment variable, a secrets manager or Odoo's System Parameters. Never put it in source code or a Git repository.
- Call the API only from servers. It refuses calls from web browsers, so a key can't work from a web page.
- Your organisation has one key. Give it only to the systems that need it, and regenerate it if anyone else has seen it.
Keys start with gp_live_ so secret scanners can spot a leaked one. They end with a checksum, so a mistyped key
fails at once with 401 invalid_key. A PUT without a valid key fails with 401 before GetPrice reads its body.
Warning: If a key leaks, an admin regenerates it at once in Settings → API & Integrations → Regenerate. The old key stops working within about a minute.
Regenerating replaces the key immediately: there is no overlap, and anything still using the old key gets
401 invalid_key within a minute. Have the place you will paste the new key open before you select
Regenerate, because the new key is shown once. Revoke on the same page removes the key without creating
a new one.