Authentication

Every request to the Zopping Platform API is authenticated with a bearer token sent in the Authorization header — the same mechanism the Zopping admin app itself uses:

GET /api/catalogue-service/product?organizationId=<org-id> HTTP/1.1
Host: zopping.com
Authorization: Bearer <your-token>

The gateway also accepts the token as a Developer-Token: or apiKey: header — they're equivalent — but Authorization: Bearer is the recommended standard.

Which token to use

There are two kinds of token, both sent the same way:

Most integrators want a Developer-Token. It's long-lived and scoped to the retailer's organization — ask your Zopping contact (the retailer's administrator) to issue one. Treat it like a password; it carries your access.

Session tokens. First-party apps log a user in and receive a short-lived accessToken, which they send as Authorization: Bearer <accessToken> on every call. This is how the Zopping admin works. Server integrations should prefer a Developer-Token so there's no login/refresh to manage.

Which gateway? This page covers the backend gateway (zopping.com/api), which is staff- and partner-authenticated — the focus for integrators. The storefront gateway (<store-domain>/api) is mostly public or end-customer-authenticated (a shopper logs in via /api/login to get a customer session); see Build a storefront.

What the token grants (RBAC)

Access is role-based. Your token maps to a grant with explicit per-resource, per-method permissions:

• An endpoint appearing in this reference means it exists, not that your token may call it.
• A 403 Forbidden means your grant is missing that resource/method — ask the retailer's admin to add it.

Scope: organization and store

• Your token is bound to one organization (the retailer). All data you read or write belongs to that tenant.
• Many resources are store-scoped. Where an endpoint operates on store-level data (price, stock, delivery slots), pass storeId — as a query parameter on GET, or in the body on writes.

Errors you may see

Next: the Quickstart.