2026
2 minute read
September
2026-09-24
Removed all references to the Marketplacer-Api-Key header and to supplying HTTP Basic Authentication credentials for staging environments, neither of which is needed any more. API keys are now always sent as Authorization: Bearer <token>. This covers the Operator, Seller and Legacy Seller API overviews and getting-started guides, the API collections pages, the 401 descriptions on the reference pages, the commercetools, HubSpot and REST migration playbooks, and the downloadable Postman and Insomnia collections.
2026-09-10
Added the OAuth for Services and Integrations playbook, covering the OAuth 2.1 client_credentials grant as the recommended way to authenticate a service or integration: why it suits a service better than an API key belonging to a person, how an operator registers a client, and a worked example using private_key_jwt. The playbook also covers choosing between client_credentials and authorization_code, how scopes apply to OAuth clients, and when DPoP-bound tokens are worth the extra work. The Operator API overview and getting-started guide, the API Key Scopes and API Key Rotation playbooks, and Start Here now point at it.
May
2026-05-05
Added the API Key Scopes playbook describing the scope set carried on every newly-issued API key — resource catalogue, level semantics (read / write / manage), MISSING_SCOPE error shape on GraphQL and REST, and guidance on choosing scopes when issuing a key. The Operator and Seller API overviews and getting-started guides have been updated to point at the new playbook.