API Credentials

Deliverect uses OAuth 2.0 for API authentication. When a partner is registered, a client_id and client_secret are issued for use in the staging environment. These credentials are used to obtain an access_token, which must be included as a Bearer token in the Authorization header of all API requests.

Authorization: Bearer your-access-token

Token Expiry & Caching

Access tokens expire at the time specified in expires_at. Always cache and reuse tokens until expiry. Do not request a new token for every API call.

Scopes

Scopes define the permissions associated with your access token (e.g., POS, Channel, Store Dispatch).

For a complete list of available scopes, see link below;

Webhooks & HMAC Authentication

Deliverect signs all outbound webhook requests using HMAC authentication.

Refer to the HMAC Authentication Guide for implementation details: