Set up a server integration
Create an OAuth application, request api_admin, and make your first Admin call.
This guide configures a server-to-server Admin integration. You need access to the Ecomiq dashboard and a store the application is allowed to operate on.
1. Select the store
Open the store in the Ecomiq dashboard. The OAuth application you create will be bound to the context authorized for that store.
The public store gets an *.ecomiq.app subdomain and may use a custom domain.
That domain selects Storefront context, not Admin context.
2. Create an OAuth application
Create an integration application from the selected store. The dashboard provides two credentials:
| Credential | Use |
|---|---|
client_id | Identifies the OAuth application. |
client_secret | Authenticates your server when it requests a token. |
Store them in a secrets manager. Never put client_secret in browser
JavaScript, a mobile app, versioned files, or application logs.
An API key is a different credential
POST /v1/api-keys creates an API key. It does not create an OAuth
application, and its value cannot be used as a client_id or client_secret
at /connect/token. These keys belong to the UCP service, whose reference is
not published yet. The Admin,
Storefront, and Auth APIs use Bearer
tokens.
3. Request a token
Send a form to Auth with the client_credentials grant
and the api_admin scope:
curl -X POST https://auth.ecomiq.pe/connect/token \
-H "Content-Type: application/x-www-form-urlencoded" \
-d "grant_type=client_credentials" \
-d "client_id=$ECOMIQ_CLIENT_ID" \
-d "client_secret=$ECOMIQ_CLIENT_SECRET" \
-d "scope=api_admin"{
"access_token": "eyJhbGciOiJSUzI1NiIsInR5cCI6...",
"token_type": "Bearer",
"expires_in": 3600
}Use expires_in to calculate expiration. Do not hard-code the token lifetime.
4. Call Admin
Send the token as a bearer credential:
curl "https://api.ecomiq.pe/api/v1/catalog/products?limit=25" \
-H "Authorization: Bearer $ECOMIQ_TOKEN"Admin gets its authorized context from the application and token claims such as
store_id and seller_id. The Admin host does not select the store. To operate
on another store, create an OAuth application there with its own access.
Verification
- The token request includes
scope=api_admin. - The secret exists only on the server or in a secrets manager.
- The application was created in the correct store and context.
- The implementation uses the parameters and responses in the endpoint reference.