OAuth - give apps access to your webshop

Shoporama supports OAuth, allowing third-party apps to securely access your online store without you having to share your password. When an app requests access, you log in with your Shoporama account, select which online store the app should have access to, and specify the access level.

Here’s how it works

1. The app sends you to Shoporama: You’ll be redirected to a login page on shoporama.dk
2. Log in: Enter your Shoporama email and password
3. Select an online store: If you have multiple online stores, choose which one the app should have access to
4. Select access level: You decide whether the app gets read access, write access, or full access
5. Authorize: Shoporama generates an API key and redirects you back to the app

Access Levels

You can choose between three access levels:

• Read-only: The app can only retrieve data (products, orders, etc.) but cannot make any changes
• Read and Write: The app can both retrieve and update data
• Full access: The app has full administrative access to the selected online store

Security

• Your password is never shared with the app; it only receives an API key
• You choose exactly which online store the app has access to
• You determine the access level
• API keys can be revoked at any time under Integrations → API Access
• All access grants are logged with the time and user
• Access is tied to the user who authorized it. If the user is removed from the online store, the key is automatically revoked, and the app stops working

When a user is removed from the online store

If you remove a user from the online store, or if you revoke the user’s access to that specific online store, all API keys the user obtained via OAuth for the online store will be revoked. This also applies to Claude, the POS app, and the scanner app. The app will then receive a 401 Unauthorized response, and if it needs access again, it must be re-authorized by a user who has access to the online store. API keys created manually under Integrations → API Access are not linked to a user and are not affected. Read more in Remove a user from your shop.

Manage Access

API keys generated via OAuth appear under Integrations → API Access in your admin panel with the prefix "OAuth:". Here you can see when the key was last used, and you can revoke access if you no longer want the app to have access.

For Developers

If you’re building an app that needs to integrate with Shoporama, you’ll find a complete OAuth guide with code examples in PHP, Laravel, JavaScript, Node.js, and Python in the API documentation. Handle a 401 Unauthorized error by having the user go through the OAuth flow again, as the key may have been revoked—for example, when the user who authorized the app has been removed from the online store.