> ## Documentation Index
> Fetch the complete documentation index at: https://developers.redo.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> How to authenticate your API requests

## Getting Your Credentials

### API Token

To create an API token:

1. Log in to your [Redo Dashboard](https://app.getredo.com)
2. Go to **Settings** → **Developer**
3. Click **Add API Client**
4. Copy the generated API secret

<Warning>
  Store your API secret securely. It will only be shown once when created.
</Warning>

### Store ID

Your Store ID is displayed in the **General** section of **Settings** →
**Developer** in the Redo Dashboard.

## API Endpoints

All API endpoints are authenticated using the Bearer authorization scheme with
your API secret.

Include your API secret in the `Authorization` header of every request:

```http theme={null}
GET /v2.2/stores/{storeId}/returns HTTP/1.1
Authorization: Bearer 77bb7598b7a972475cc7c7e171ec33af
Host: api.getredo.com
```

<Warning>
  Never share your API secret publicly or commit it to version control.
</Warning>

### Example Request

```bash theme={null}
curl -X GET "https://api.getredo.com/v2.2/stores/store_123/returns" \
  -H "Authorization: Bearer YOUR_API_SECRET"
```

## Access scopes

API tokens carry **access scopes** that determine which protected endpoints they
may call. For example, listing returns requires `returns_read`, and a request is
rejected with `403 Forbidden` if the token does not hold it.

Choose a client's scopes in **Settings** → **Developer** when you create its
token, and update them at any time without re-issuing the token. Endpoints that
require a scope list it in this reference.

<Note>
  Public storefront coverage endpoints do not require an access scope. A token
  used only for those endpoints can be created with no scopes selected.
</Note>

<Note>
  Tokens created before access scopes were introduced were granted all scopes,
  so they keep working unchanged. Newly created tokens only carry the scopes you
  select.
</Note>

See [Access scopes](/docs/api-reference/scopes) for the full list and how to
grant them.

## Webhooks

Webhooks are authenticated using the Bearer authorization scheme with a secret
**you provide** when creating the webhook subscription.

Redo will include this secret in the `Authorization` header when delivering
webhook events to your endpoint:

```http theme={null}
POST /events HTTP/1.1
Authorization: Bearer subscriberauth123
Host: subscriber.example.com
```

**Always verify the Authorization header** in your webhook handler before
processing events.

### Webhook Event Delivery

* Webhook events are delivered **in order** for each individual subject (e.g.,
  return)
* If the response is not a 2xx status code, the event will be retried multiple
  times before discarding it

See the [Webhooks guide](/docs/guides/integrations/webhooks) for detailed setup
instructions.