2026
less than a minute
September
2026-09-10
Added the OAuth for Services and Integrations playbook, covering the OAuth 2.1 client_credentials grant as the recommended way to authenticate a service or integration: why it suits a service better than an API key belonging to a person, how an operator registers a client, and a worked example using private_key_jwt. The playbook also covers choosing between client_credentials and authorization_code, how scopes apply to OAuth clients, and when DPoP-bound tokens are worth the extra work. The Operator API overview and getting-started guide, the API Key Scopes and API Key Rotation playbooks, and Start Here now point at it.
May
2026-05-05
Added the API Key Scopes playbook describing the scope set carried on every newly-issued API key — resource catalogue, level semantics (read / write / manage), MISSING_SCOPE error shape on GraphQL and REST, and guidance on choosing scopes when issuing a key. The Operator and Seller API overviews and getting-started guides have been updated to point at the new playbook.