Authentication

The Authentication API is the entry point for securing access to the platform. Before accessing protected APIs, each request must include a valid access token obtained through the authentication endpo

* Required Request

Headers

Authorization: Bearer ••••••••••••••••••••••••••••••••••••

All API requests must include the required authentication headers: Authorization: Bearer token (your API key)

Create App API Key

Go to Preorder App -> Settings page -> Mail SMTP & API

Create APP API key -> select scope & exprise

A confirmation email will be sent to the owner.

You need to access your email and verify to receive the API Key.

You can revoke and rotate the API key at any time.

Base API URL

https://preorder.globo.io/shop-api/

The base endpoint for all API requests. Append the corresponding API path to this URL when making requests.

Limit

throttle:60,1

Rate Limit: Maximum 60 requests per minute per client. Requests exceeding this limit will be rejected with 429 status

---

Scopes

Each API token is issued one or more scopes, which determine which endpoints that token can call. There are 6 scopes, organized as read/write pairs per feature area:

Scope	Description	Grants
read_preorders	Read pre-order offers & products	View offers, view pre-order product lines
write_preorders	Manage pre-order offers & products	Create/update/delete offers, update/delete product lines, toggle continue-selling — and automatically includes read_preorders
read_coming_soon	Read coming soon products	View coming-soon rules
write_coming_soon	Manage coming soon products	Create/update/delete coming-soon rules — and automatically includes read_coming_soon
read_back_in_stock	Read back in stock submissions	View back-in-stock submissions
write_back_in_stock	Manage back in stock submissions	Create/update/delete submissions, send restock notification emails — and automatically includes read_back_in_stock

Note: a write_x scope always implies the matching read_x scope. For example, a token issued with only write_preorders can still call GET /shop-api/pre-order/list without needing read_preorders granted separately. The reverse is not true: a token with only read_preorders will be rejected on any write endpoint (create/update/delete).

Scope required per endpoint

Endpoint	Method	Required scope
/back-in-stock/list, /back-in-stock/get/{id}	GET	read_back_in_stock
/back-in-stock/create, /update, /delete, /send-notify-restock	POST/PUT/DELETE	write_back_in_stock
/coming-soon/list, /coming-soon/get/{id}	GET	read_coming_soon
/coming-soon/create, /update, /delete	POST/PUT/DELETE	write_coming_soon
/pre-order/list, /pre-order/get/{id}	GET	read_preorders
/pre-order/products/list, /products/get-products-shopify	GET	read_preorders
/pre-order/create, /update, /delete	POST/PUT/DELETE	write_preorders
/pre-order/products/update, /products/delete, /products/toggle-continue-selling	PUT/DELETE/POST	write_preorders
/ping	GET	No specific scope required — any valid token passes

Missing-scope error (403)

When a token lacks the required scope, the API returns:

{
  "success": false,
  "message": "This API token is missing required scope: write_preorders",
  "required_scopes": ["write_preorders"],
  "missing_scopes": ["write_preorders"]
}

• required_scopes: every scope this endpoint requires.

• missing_scopes: the subset the current token doesn't have (differs from required_scopes when the token already holds part of what's needed — e.g. it has read_preorders but is missing write_preorders).

---

Test API

HTTP

GET /ping HTTP/1.1
Host: preorder.globo.io/shop-api
Authorization: Bearer ••••••••••••••••••••••••••••••••••••

Javascript - fetch

const myHeaders = new Headers();
myHeaders.append("Authorization", "************");
const requestOptions = {
    method: "GET",
    headers: myHeaders,
    redirect: "follow"
};
fetch("https://preorder.globo.io/shop-api/ping", requestOptions)
    .then((response) => response.text())
    .then((result) => console.log(result))
    .catch((error) => console.error(error));

PHP

$curl = curl_init();
curl_setopt_array($curl, array(
  CURLOPT_URL => 'https://preorder.globo.io/shop-api/ping',
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => '',
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 0,
  CURLOPT_FOLLOWLOCATION => true,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => 'GET',
  CURLOPT_HTTPHEADER => array(
    'Authorization: ************'
  ),
));

$response = curl_exec($curl);

curl_close($curl);
echo $response;

Success

{
    "success": true,
    "message": "API is working"
}

Unauthorized

// Missing API token 401
{"success": false, "message": "Missing API token"}
// Invalid or revoked API token 401
{"success": false, "message": "Invalid or revoked API token"}
// Insufficient token scope 403
{"success": false, "message": "Insufficient token scope"}