Apps & credentials
Credential kinds
| Kind | Client ID | Host | Available from |
|---|---|---|---|
| Sandbox | mp_<16 chars> | sandbox.open.mallplus.ph | App creation |
| Production | mp_live_<16 chars> | open.mallplus.ph | After go-live approval |
Credentials are environment-specific. Sending a credential to the host it does not belong to returns
401 INVALID_CREDENTIALS. Keep the client ID and its secret together. The host check reads the client ID alone, so a client ID
signed with a different credential's secret is not caught there — it returns 401 INVALID_SIGNATURE.
Rotating secrets
Sandbox rotate: the previous secret still signs every /open/v1/* request, including OAuth (/open/v1/auth/authorize, /auth/token, /token/refresh, and /revoke), for 24 hours, then 401 INVALID_SIGNATURE. Live rotate (/rotate-live-secret) invalidates the previous live secret immediately on every surface. On the production API host, OAuth does not honour the overlap: sign OAuth calls there with the new secret. Deploy the new secret before the overlap ends, or at the same moment you rotate live.
Scopes
Scopes are granted per app and consented to per seller. A call missing its scope returns 403 FORBIDDEN.
| Scope | Grants |
|---|---|
| catalog:read | Read products and categories |
| catalog:write | Create, update and delete products |
| orders:read | Read orders, returns, shipping options and payouts |
| orders:write | Ship and cancel orders, manage returns |
| inventory:read | Read inventory levels |
| inventory:write | Update inventory levels |
| fulfillment:read | Read fulfillments |
| fulfillment:write | Create and update fulfillments |
| seller:read | Read seller and shop information |
| customer:contact:read | Reserved — not available. The buyer phone and street address are masked by design to protect buyer privacy; this scope does not unmask them. Use customerId to identify the buyer |
| customer:email:read | Reserved — not available. The buyer email is withheld by design to protect buyer privacy; this scope does not release it, and orders carry no buyerEmail. Use customerId to identify the buyer |