Choose key scopes

What to expect

The developer console supports app records, scoped API keys, and webhook registration. Registration does not mean webhook delivery is enabled. No isolated sandbox, published quota system, or generic /api/v1 API is documented here. Keep secret credentials on trusted servers.

A key should have only the permissions its job requires. This guide covers 3 practical actions, in the order they usually happen.

Do this first

Use apps:read for reading app records..

Add apps:write, keys:write, or webhooks:write only when needed..

Then finish with

Create a separate key for a different responsibility..

Good to know

Everything here reflects the current Merchant Bridge interface. Labels and buttons may move as the product evolves, but the flow stays the same: prepare, act on the page this guide references, and confirm the result before moving on.

When something does not match what you see, the destination page for this guide is the source of truth.