Authorization and Scopes

Every API key is bound to one Remy merchant. Requests can only read or change resources owned by that merchant, including issued vouchers and rewards.

Current access model

The current public integration keys do not expose configurable OAuth-style scopes. A valid key can call the endpoints documented in this developer hub for its linked merchant.

Use a separate key for each integration so access can be revoked independently. Never use a key belonging to one merchant to identify or operate on another merchant's resources; cross-merchant identifiers return 404.

Endpoint-level scopes may be introduced as the API expands. Any future scope requirements will be listed on the affected endpoint page and in the OpenAPI specification.