Skip to main content

​
Credential model

An API token is a single-shop credential for header-based MCP clients. It looks like abcv_live_1lRrF_CdEOYbg6xCP6FFoiFnOcp05s8E.
Claude.ai and Claude Desktop connectors added by URL use OAuth discovery plus a short-lived connect code from ABConvert. They do not require a merchant-generated OAuth Client ID or Client Secret.

One token per header-based app

Mint a separate token for each header-based integration, such as Claude Code or your team’s automation. Revoking one does not break the others.

Shop-scoped

A token or OAuth connection for Shop A can never access Shop B’s data — even if you own both.

OAuth access tokens expire

Connector OAuth access tokens expire automatically and are refreshed by the connector. API tokens remain valid until you revoke them.

Revocable API tokens

In Settings → MCP & API Access, revoke a header-based API token. The next request using it returns 401.

​
Treat credentials like passwords

A token carries the access you gave it when you created it. A read and write token can do anything you can do through MCP — create tests, change rates, or end tests. A read only token can list and read tests and query their results, and nothing else. Tokens created before scopes existed (they start with abc_) have read and write access. Keep tokens and one-time connect codes private.
Don’t:
  • Paste tokens or connect codes in shared Slack channels, GitHub issues, or screenshots
  • Commit tokens to a repo (even a private one)
  • Email tokens in plaintext
  • Store tokens in a shared password vault unless your team genuinely needs shared access
Do:
  • Mint a personal token for each team member, not a shared one
  • Name tokens descriptively (“Claude Code — Jeff”, not “token1”)
  • Revoke tokens you stop using immediately
  • Set a recurring reminder to audit your token list quarterly

​
What protects you by default

Even if a token leaks, several layers limit blast radius: 1. Per-shop feature flag. MCP is opt-in per shop. If your shop has the flag off, even a valid token cannot do anything. 2. Rate limit. 200 requests per minute per token, server-enforced. A leaked token cannot be used to hammer the API or run an unbounded loop. 3. Token kill switch. Revoke a header-based API token from Settings → MCP & API Access. Effective within one request. 4. Resource overlap protection. Even with a leaked token, an attacker cannot launch a price test on a product that already has an active price test running. The same protection applies to shipping zones, themes, templates, and redirect URLs. 5. Backend audit trail. Every API call is logged with the token ID, timestamp, and outcome. Contact support if you need to investigate suspicious activity.

​
Auditing token usage

Today, the in-app audit view is read-only and shows:
  • Token name and creation time
  • Last successful use timestamp
  • Whether the token is active or revoked
A more granular activity log (which tools were called, when, and by which client) is on the roadmap. If you need it sooner, contact support — we can pull logs server-side on request.

​
When to rotate

Rotate (revoke + mint a new token) when:
  • A team member leaves
  • You change laptops
  • You suspect leakage (committed to git by accident, pasted in a public chat, or a lost device)
  • Quarterly as part of a routine audit

​
What’s NOT covered yet

These are on the roadmap:
  • OAuth for every client. Claude.ai and Claude Desktop can connect through the URL-only OAuth flow. Other clients may still require a manually pasted token.
  • Scopes finer than read and write. You choose read only or read and write when you create a token. Narrower scopes, such as a token that can read one test, are not available yet.
  • Per-IP allowlist. Lock a token to specific IP ranges (for example, your office) for extra defense.
If any of these would change your decision to use MCP, let support know — that’s how we prioritize.

​
Reporting a suspected leak

If you think a token has been compromised:
  1. Revoke it immediately in Settings → MCP & API Access. Do not wait.
  2. Check the audit timestamps — was the token used recently from somewhere unexpected?
  3. Email [email protected] with the token’s name and approximate compromise window. We’ll pull server-side logs and confirm whether anything unusual happened.
The fastest mitigation is always step 1. Do not delay revocation while you investigate.