Skip to main content
API tokens carry access scopes that determine which endpoints they may call. A request is rejected with 403 Forbidden unless the token holds the scope required by the endpoint.
Tokens created before access scopes were introduced were granted all scopes, so they keep working unchanged. Newly created tokens only carry the scopes you select.

​
Granting scopes

Select a token’s scopes when you create it, and update them at any time — no need to re-issue the token:
  1. Log in to your Redo Dashboard
  2. Go to Settings → Developer
  3. Create an API client (Add API Client) or open an existing one
  4. Select the scopes the client needs and save
Grant a client only the scopes it needs — read scopes for endpoints that only retrieve data, write scopes for endpoints that create, update, or delete.

​
Available scopes

Each endpoint in this reference lists the scope it requires. The full set of scopes:
ScopeAccessGrants
orders_readReadRetrieve orders.
orders_writeWriteCreate, update, and delete orders; manage fulfillments.
customers_readReadRetrieve customers.
customers_writeWriteCreate and update customers and subscriptions.
products_writeWriteBulk upload products.
returns_readReadList and retrieve returns and return tags.
returns_writeWriteCreate, update, and process returns; manage return tags.
inventory_readReadList inventory items and levels.
inbound_shipments_readReadList and retrieve inbound shipments.
invoices_readReadList invoices.
webhooks_readReadList and retrieve webhooks.
webhooks_writeWriteCreate, update, delete, and replay webhooks.
customer_events_writeWriteCreate custom customer events.
storefront_events_writeWriteCreate storefront events.

​
Insufficient scope

When a token is missing a required scope, the API returns 403 Forbidden with a problem response: 
{
  "detail": "This token is missing the required `returns_read` scope",
  "title": "Insufficient token scope",
  "type": "com.getredo.api:scope/forbidden"
}
Add the missing scope to the token in the Dashboard to resolve it — you don’t need to re-issue it.