Authentication
The Authentication API is the entry point for securing access to the platform. Before accessing protected APIs, each request must include a valid access token obtained through the authentication endpo
* Required Request
Headers
Authorization: Bearer ••••••••••••••••••••••••••••••••••••
All API requests must include the required authentication headers: Authorization: Bearer token (your API key)
Create App API Key
Go to Preorder App -> Settings page -> Mail SMTP & API

Create APP API key -> select scope & exprise

A confirmation email will be sent to the owner.
You need to access your email and verify to receive the API Key.

You can revoke and rotate the API key at any time.

Base API URL
https://preorder.globo.io/shop-api/
The base endpoint for all API requests. Append the corresponding API path to this URL when making requests.
Limit
throttle:60,1
Rate Limit: Maximum 60 requests per minute per client. Requests exceeding this limit will be rejected with 429 status
Scopes
Each API token is issued one or more scopes, which determine which endpoints that token can call. There are 6 scopes, organized as read/write pairs per feature area:
read_preorders
Read pre-order offers & products
View offers, view pre-order product lines
write_preorders
Manage pre-order offers & products
Create/update/delete offers, update/delete product lines, toggle continue-selling — and automatically includes read_preorders
read_coming_soon
Read coming soon products
View coming-soon rules
write_coming_soon
Manage coming soon products
Create/update/delete coming-soon rules — and automatically includes read_coming_soon
read_back_in_stock
Read back in stock submissions
View back-in-stock submissions
write_back_in_stock
Manage back in stock submissions
Create/update/delete submissions, send restock notification emails — and automatically includes read_back_in_stock
Note: a
write_xscope always implies the matchingread_xscope. For example, a token issued with onlywrite_preorderscan still callGET /shop-api/pre-order/listwithout needingread_preordersgranted separately. The reverse is not true: a token with onlyread_preorderswill be rejected on any write endpoint (create/update/delete).
Scope required per endpoint
/back-in-stock/list, /back-in-stock/get/{id}
GET
read_back_in_stock
/back-in-stock/create, /update, /delete, /send-notify-restock
POST/PUT/DELETE
write_back_in_stock
/coming-soon/list, /coming-soon/get/{id}
GET
read_coming_soon
/coming-soon/create, /update, /delete
POST/PUT/DELETE
write_coming_soon
/pre-order/list, /pre-order/get/{id}
GET
read_preorders
/pre-order/products/list, /products/get-products-shopify
GET
read_preorders
/pre-order/create, /update, /delete
POST/PUT/DELETE
write_preorders
/pre-order/products/update, /products/delete, /products/toggle-continue-selling
PUT/DELETE/POST
write_preorders
/ping
GET
No specific scope required — any valid token passes
Missing-scope error (403)
When a token lacks the required scope, the API returns:
required_scopes: every scope this endpoint requires.missing_scopes: the subset the current token doesn't have (differs fromrequired_scopeswhen the token already holds part of what's needed — e.g. it hasread_preordersbut is missingwrite_preorders).
Test API
Success
Unauthorized
Last updated
Was this helpful?