Platform Open API

Updated October 26, 2026

Query shop, product, order, payout, and membership data through Fourthwall's Platform Open API

The Platform Open API gives you and your apps access to shop data through a single host. Use it to pull current shop details, products, orders, and memberships into custom tools, dashboards, or integrations you build on the Developer Platform.

Host and base URL

All Platform Open API requests use this base URL:

https://api.fourthwall.com/open-api/v1.0/

If you call a different host, the request will fail authentication even with valid credentials.

Authentication

The Platform Open API accepts two kinds of credentials, and each is sent a different way.

Basic auth for your own shop

Use the username and password from the Open API section of Settings > For developers. Click Create API User if you haven't yet, then copy the username and password it shows. Only a user with the Super Admin role can create an API user. If the dashboard asks you to confirm with a code sent to your email (or with a passkey) when you open For developers, enter the code to continue. Send them with HTTP Basic auth on every request. For example, with curl:

curl -u YOUR_USERNAME:YOUR_PASSWORD https://api.fourthwall.com/open-api/v1.0/shops/current

Don't send your username or password as an Authorization: Bearer token.

OAuth for apps on the Developer Platform

1. Register an app under Settings > Platform apps. See Developer Platform.
2. Complete the OAuth flow so the creator grants your app the scopes it needs.
3. Include the access token in every request using the Authorization header:

Authorization: Bearer YOUR_OAUTH_TOKEN

OAuth scopes

Most endpoints are gated by a scope your app requests during OAuth. Creators see and approve these scopes on the consent screen, and Fourthwall only issues tokens for the scopes they accept.

Most scopes come in read and write pairs. The ones most apps need:

• shop_read for shop contact info and the mailing list (GET /shops/current needs no scope)
• offer_read and offer_write for products
• order_read and order_write for orders
• memberships_read and memberships_write for memberships
• webhook_read and webhook_write for webhooks

The OAuth guide and each endpoint's reference page list the full set and the scope each endpoint needs.

If your app calls an endpoint outside its granted scopes, the request returns 401. Request only the scopes you actually need so creators see a clear, minimal permissions screen.

Key endpoints

The most common endpoints are listed below. For full request, response, and field documentation, see the Platform Open API reference.

GET /shops/current

Returns the shop your credentials belong to, or the shop that authorized your app's OAuth token. This is the Platform Open API equivalent of /me: use it to identify which shop the request is acting on after a creator authorizes your app.

GET https://api.fourthwall.com/open-api/v1.0/shops/current

GET /products

Returns the shop's products, with pagination (up to 100 per page). Get a single product with GET /products/{productId}.

GET https://api.fourthwall.com/open-api/v1.0/products

GET /order

Returns orders placed in the shop, with pagination (up to 100 per page). Use this for fulfillment tools, reporting, or syncing order state into external systems. The path is singular: /order, not /orders. Get a single order with GET /order/{orderId}, or by the order number customers see with GET /order/by-friendly-id/{friendlyId}.

GET https://api.fourthwall.com/open-api/v1.0/order

GET /memberships/members and GET /memberships/tiers

/memberships/members returns the shop's members, with pagination (up to 100 per page). /memberships/tiers returns the shop's membership tiers. Use these for retention reporting, member exports, or syncing membership status to a community platform.

GET https://api.fourthwall.com/open-api/v1.0/memberships/members
GET https://api.fourthwall.com/open-api/v1.0/memberships/tiers

What are the rate limits?

Most Platform Open API endpoints allow 100 requests per 10 seconds per shop. A few write endpoints are tighter: POST /products and POST /customizations allow 5 requests per minute, and POST /media/upload-url allows 20 per minute. Over the limit, the API returns 429 Too Many Requests with the code OPEN_API_TOO_MANY_REQUESTS. Wait and retry. Limits can change, so check the rate limiting guide for the current numbers.

What 401 means on this API

A 401 Unauthorized response on the Platform Open API points to one of four causes:

• Wrong host. You sent the request to a different API host. The Platform Open API only answers on api.fourthwall.com/open-api/v1.0/.
• Wrong auth method. You sent your Open API username and password as a Bearer token. Send them with Basic auth instead.
• Missing scope. Your OAuth token does not include the scope required for that endpoint group. Re-run the OAuth flow and request the right scopes.
• Expired or revoked token. The access token has expired, or the creator revoked your app. Refresh the token using the refresh token from the OAuth flow, or prompt the creator to reauthorize.

Check the response body for the specific error code before assuming the cause.

Compare the Fourthwall APIs

Two Fourthwall APIs use the credentials from Settings > For developers. Pick the one that matches your use case.

API	Host	Auth	Use case
Storefront API	storefront-api.fourthwall.com	Storefront API token in the storefront_token query parameter	Build a custom headless storefront with products, cart, and checkout redirect.
Platform Open API	api.fourthwall.com/open-api/v1.0/	Open API username and password (Basic auth), or an OAuth bearer token scoped per endpoint group	Your own tools, or apps on the Developer Platform that read shop, product, order, or membership data on a creator's behalf.

For more on the Storefront API, see Storefront API.

Frequently asked questions

Which credentials work with the Platform Open API?

For your own shop, use the username and password from the Open API section of Settings > For developers, sent with Basic auth. Apps you register under Settings > Platform apps use OAuth access tokens instead, scoped to what the creator approved.

What is the Platform Open API equivalent of /me?

GET /shops/current. It returns the shop your credentials belong to, or the shop that authorized your app's OAuth token.

Can I write data through the Platform Open API?

Yes, for some resources. The endpoints listed above are read endpoints, and the API also has write endpoints, such as creating products (POST /products). Check the full API reference for the current set of write endpoints and the scopes they require.

How do I refresh an expired token?

Use the refresh token returned by the OAuth flow against the token endpoint, the same way you exchanged the initial authorization code. See Developer Platform for the full OAuth flow.

Where is the full API reference?

The complete reference, including every endpoint, request schema, and response field, is at docs.fourthwall.com/api-reference/platform/.