Authentication

The REST API uses the same API keys as AI / Agent access. Mint a key, then send it as a bearer token.

The REST API requires the Elevate plan

Anyone can mint API keys on any plan — they work for AI / Agent access (MCP) regardless of plan. The REST API specifically is an Elevate-plan feature: a request from a shop that isn’t on Elevate returns 403 PLAN_REQUIRED, even with a valid key. The plan is checked on every request against your current subscription, so a downgrade takes effect immediately.

Get a key

Create an API key in the Agent Access tile of the app. The full walkthrough (and how to revoke) lives in the Agent-access docs:

API keys (mint, scope, revoke) →

Pick the right scope

Scope	Can call
read	GET only
write	GET, plus POST / PATCH / DELETE

A read key sent to a write endpoint gets 403 FORBIDDEN_SCOPE, naming the operation it refused. Nothing is changed, and the failure happens before any of your data is touched.

{
  "error": {
    "code": "FORBIDDEN_SCOPE",
    "message": "purchaseOrders.receive requires the 'write' scope",
    "retryable": false,
    "requestId": "0f8c…"
  }
}

Tip

Use the narrowest scope that does the job. If your integration only reads, mint a read key — it physically cannot create, change, or delete anything. Give a write key only to the integration that needs to change purchase orders, and keep a separate read key for everything else.

The pairing is enforced on our side, not just documented: every endpoint is bound at startup to exactly one operation and one required scope, so a write can never be reached through a GET, and a read never through a POST.

Send the token

Put the key in the Authorization header:

curl -s -H "Authorization: Bearer lstk_xxxxxxxx" \
  "https://prod.logistified.app/api/v1/purchase-orders"

• A missing or invalid token returns 401 immediately — before any data is touched.
• A revoked key returns 401. Revoke in the Agent-Access tile at any time.
• The key identifies your shop on its own; there is no shop id in the URL.

Tip

Keep keys server-side. Because auth is a bearer token (not a cookie), there’s no CSRF risk — but a leaked write key can change your purchase orders until you revoke it. Rotate by minting a new key and revoking the old one.

Managing access

Each request is recorded in the audit log (tagged rest:), so you can see which key made which call — writes included, so every change is traceable to the key that made it. Manage and revoke keys from the Agent-Access tile.

Managing access & security →