Authentication
API keys, scopes, test mode and the security rules that protect your store.
All requests are authenticated with a store-scoped API key sent as a Bearer token:
curl https://api.nembol.com/rest/v1/store \
-H "Authorization: Bearer nbl_live_xxxxxxxxxxxxxxxxxxxxxxxx"Keys are created in the Nembol dashboard under Settings → Developers by the store owner. The full secret is shown once, at creation — store it in a secret manager. Afterwards only the name and prefix are visible.
Key modes
| Prefix | Mode | Behavior |
|---|---|---|
nbl_live_ | Live | Full access; writes propagate to your channels. |
nbl_test_ | Test | Everything is validated and simulated; nothing is persisted and no channel is ever touched. Simulated channel results are marked "simulated". |
Integrate with a test key first; switch to a live key when your flows work.
Use your key in the examples
Paste a test key (nbl_test_…) and every code block on this site fills it in for you. It is stored only in this browser — never sent anywhere.
Scopes
Each key carries only the scopes you grant it:
| Scope | Grants |
|---|---|
products:read | Read products, variants, listings |
products:write | Create, update, delete products and images |
inventory:write | Update quantity and price only (safer for stock-sync integrations) |
listings:write | Publish and delist per channel |
orders:read | Read orders — includes buyer personal data; process it lawfully |
webhooks:manage | Manage webhook endpoints |
events:read | Read the event log |
Requests without the needed scope fail with 403 and
error.type: "authentication_error".
Security rules
- Never use API keys in browser or mobile code. The API is server-to-server; browsers are blocked by CORS by design (the only allowed origin is this documentation's playground).
- One integration, one key — don't share keys between systems, so you can roll one without breaking the others.
- Roll immediately if a key leaks (dashboard → key → Roll): the old secret stops working at once, and you get a new secret shown once.
- Keys can be revoked at any time; revocation is immediate.
Last updated on July 28, 2026
Need help?
The API is in private beta — email us and a human replies, usually within one business day.