API tokens

Insight, then API tokens. Tokens authenticate the REST API.

Creating one

Give it a name that says where it is used, for example "Zapier production" or "Warehouse script", then Create token. The token is shown once. Copy it then; it cannot be shown again.

Pass it as a bearer token:

curl -H "Authorization: Bearer {token}" \
     -H "Accept: application/json" \
     https://yourshop.printersfriend.com/api/v1/orders

Plan gate

The API needs Premium or above. The entitlement is checked on every request, not just when the token is issued, so a downgrade stops API access immediately even for tokens that already exist.

Security

Rule	Why
One token per integration	You can revoke one without breaking the others
Never commit a token to a repo	It is a credential with your shop's data behind it
Revoke rather than rotate secrets by hand	Deleting a token is immediate
Deactivating a user kills their tokens	Which is why offboarding is one action, not two

Tokens inherit the permissions of the user who created them, so a token created by a viewer can read and not write.

Rate limits

Read and write endpoints have separate limits, with writes capped more tightly. If you are bulk-loading, throttle your side rather than retrying hard against a limit.