Authentication
API keys, scopes, test mode and the security rules that protect your store.
All requests are authenticated with a store-scoped API key sent as a Bearer token:
curl https://api.nembol.com/rest/v1/store \
-H "Authorization: Bearer nbl_live_xxxxxxxxxxxxxxxxxxxxxxxx"Keys are created in the Nembol dashboard under Settings → Developers by the store owner. The full secret is shown once, at creation. Store it in a secret manager. Afterwards only the name and prefix are visible.
Key modes
| Prefix | Mode | Behavior |
|---|---|---|
nbl_live_ | Live | Full access; writes propagate to your channels. |
nbl_test_ | Test | Everything is validated and simulated; nothing is persisted and no channel is ever touched. Simulated channel results are marked "simulated". |
Integrate with a test key first; switch to a live key when your flows work. Partners can also run the whole integration for real, unbilled, in the sandbox.
Use your key in the examples
Paste a test (nbl_test_…) key and every code block on this site fills it in for you. It is stored only in this browser and never sent anywhere.
Scopes
Each key carries only the scopes you grant it:
| Scope | Grants |
|---|---|
products:read | Read products, variants, listings |
products:write | Create, update, delete products and images |
inventory:write | Update quantity and price only (safer for stock-sync integrations) |
listings:write | Publish and delist per channel |
orders:read | Read orders. Includes buyer personal data, so process it lawfully |
orders:write | Mark orders shipped, attach tracking, notify the marketplace |
webhooks:manage | Manage webhook endpoints |
events:read | Read the event log |
channels:write | Change channel account settings: sync rules, price rule, quantity cap, default policies/collection |
channels:connect | Connect and disconnect channel accounts, manage the redirect URLs used by connect links |
billing:read | Read the store's plan, usage, payment method and invoices |
storefront:write | Storefront settings (not payments), discount codes and bundles |
promotions:write | Create, change, stop and delete promotions (timed sales on the channels) |
billing:manage | Create links to subscribe, change plan, update the card, cancel or renew; restart the free trial |
accounts:manage | Partners only. Create, change and close your companies, read the partner statement and billing, and work inside a company with the Nembol-Account header (without this permission, any request with that header answers 403 insufficient_scope). It appears in Settings → Developers only on a partner account, and the Read & write preset includes it. See Partner program. |
Requests without the needed scope fail with 403 and
error.type: "authentication_error".
Security rules
- Never use API keys in browser or mobile code. The API is server-to-server; browsers are blocked by CORS by design (the only allowed origin is this documentation's playground).
- One key per integration. Don't share keys between systems, so you can roll one without breaking the others.
- Roll immediately if a key leaks (dashboard → key → Roll): the old secret stops working at once, and you get a new secret shown once.
- Keys can be revoked at any time; revocation is immediate.
Last updated on October 17, 2026
Need help?
Email us and a human replies, usually within one business day.