Authentication · ShopItUp Developers

Partner access

OAuth 2.0 client credentials

For an agent acting for a guest: search the catalogue, price orders and create checkouts. ShopItUp issues the partner a client ID and secret, and the partner exchanges them for a token at https://shopitup.ca/oauth/token.

Each token lasts an hour; request a new one when it expires. Leave out scope to get every scope your client holds — the response's scope lists what the token carries.

Keep the secret on your servers. A partner's credentials can be revoked at any time, and its tokens stop working at once.

Get a token

curl -X POST "https://shopitup.ca/oauth/token" \
  -d grant_type=client_credentials \
  -d client_id=$CLIENT_ID \
  -d client_secret=$CLIENT_SECRET \
  -d scope="catalog:read checkout:write"

Response

{
  "token_type": "Bearer",
  "expires_in": 3600,
  "access_token": "eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiJ9…",
  "scope": "catalog:read checkout:write"
}

Account linking

OAuth 2.0 authorization code with PKCE

For an agent acting for a person who has a ShopItUp account: their orders and tracking, and their saved sizes to filter searches by what fits.

Account linking is switched on for your client during onboarding: send us the exact https redirect address (or addresses) your app receives the person at. PKCE with S256 and a scope are required on every request, even though your server also sends its client secret. The person must have confirmed their email address.

A checkout you create with a linked person's token joins their account when they pay with that account's email, so it appears in /me/orders.

An access token lasts an hour. A refresh token lasts 30 days and is replaced each time you use it, so keep the new one. profile:read and orders:read are only ever on a token a person approved, never on your client credentials token.

Send the person to https://shopitup.ca/oauth/authorize with your client ID, redirect address, the scopes you need and a PKCE code challenge.
They sign in to ShopItUp and see exactly what your app is asking for. If they approve, they return to your redirect address with a one-time code.
Exchange the code, with your code verifier, for an access token and a refresh token.
Use the refresh token for a new access token when it expires. The person can disconnect your app from their ShopItUp account at any time.

Link an account

https://shopitup.ca/oauth/authorize
  ?response_type=code
  &client_id=$CLIENT_ID
  &redirect_uri=https://example.com/callback
  &scope=profile:read%20orders:read
  &state=$STATE
  &code_challenge=$CODE_CHALLENGE
  &code_challenge_method=S256

curl -X POST "https://shopitup.ca/oauth/token" \
  -d grant_type=authorization_code \
  -d code=$CODE \
  -d redirect_uri=https://example.com/callback \
  -d client_id=$CLIENT_ID \
  -d client_secret=$CLIENT_SECRET \
  -d code_verifier=$CODE_VERIFIER

curl -X POST "https://shopitup.ca/oauth/token" \
  -d grant_type=refresh_token \
  -d refresh_token=$REFRESH_TOKEN \
  -d client_id=$CLIENT_ID \
  -d client_secret=$CLIENT_SECRET

Connect from an AI assistant (MCP)

The same API as tools, for any assistant that speaks the Model Context Protocol

Add ShopItUp as a connector in Claude, ChatGPT or any MCP client. Two addresses, as the website has: browsing and guest checkout need no account, and a signed-in connection adds the person's own orders and sizes. In Claude, ShopItUp is also listed in the connector directory. In ChatGPT, ShopItUp is an app you can open directly.

Each tool is the endpoint of the same name: the same rules, results and error codes, and the person always pays on the store's own checkout. The signed-in connection uses OAuth 2.1: an assistant finds our sign-in at https://sandbox.shopitupbeta.ca/.well-known/oauth-protected-resource/mcp/account, registers itself if it is one we accept, and the person approves it on ShopItUp's consent page.

https://sandbox.shopitupbeta.ca/mcp No sign-in

search_products get_product get_store list_categories create_quote create_checkout get_checkout cancel_checkout
https://sandbox.shopitupbeta.ca/mcp/account The person signs in and approves

Everything above, plus the person's own account:

get_me get_my_shipping_address list_my_orders get_my_order

Scopes

Ask only for what your agent uses. Each endpoint page lists the scope it needs.

Scope	Allows	Who can hold it
`catalog:read`	Search items and read item and store details	A partner, or a linked account
`checkout:write`	Create quotes and checkouts	A partner, or a linked account
`profile:read`	Read the person's name, email and saved sizes	Only a linked account — the person grants it
`orders:read`	Read the person's orders and tracking	Only a linked account — the person grants it
`address:read`	Read the person's saved shipping address	Only a linked account — the person grants it
`purchase:write`	Buy for the person with their saved card, within the limits they set — elevated, only for an assistant registered at /oauth/register/agent and only when the person ticks it on the consent page	Only a linked account — the person grants it
`alerts:write`	Set, list and stop the person's price-drop alerts (an email when an item drops to their price; never a purchase)	Only a linked account — the person grants it

Sandbox

The sandbox at https://shopitupbeta.ca/api/v1 has test stores and uses Stripe test mode, so you can run the whole flow, including payment with a test card, without a real order. Sandbox and production issue separate credentials.

To get credentials, apply in the developer portal — or write to [email protected].