CartKestrel · Reference guide
Catalog access, for future planning
What Shopify and WooCommerce require before a separate product can read a shop catalog. These platform requirements are background information, not CartKestrel setup steps.
01 · Shopify
Admin-created custom app
In this documented access model, a merchant creates a custom app in Shopify admin and installs it in the shop. The installation generates its Admin API access token.
- Token visibility: Shopify shows the token only once when it is generated, so it must be stored securely at that time.
- Getting a replacement: Shopify does not support rotating this app’s token. The app must be uninstalled and reinstalled to generate a new token.
- API requests: The token is the bearer credential for GraphQL Admin API requests. Shopify documents sending it in the
X-Shopify-Access-Tokenheader.
Shopify’s current documentation says new admin-created custom apps can no longer be created, while existing apps continue to work. CartKestrel has not chosen or implemented a future Shopify app path.
Shopify admin app token documentation02 · WooCommerce
WordPress-generated API keys
A WordPress administrator generates a consumer key and consumer secret in WooCommerce settings for a selected WordPress user.
- Key permissions: The administrator selects Read, Write, or Read/Write access. The key’s effective permissions are also limited by the selected user’s WordPress roles and capabilities.
- Authentication: REST API requests use HTTP Basic authentication, with the consumer key as the username and the consumer secret as the password.
- API version: The current WooCommerce REST API integration is v3.