Authentication & limits#

Bearer token#

Every request to https://app.syncore.gr/api/v1 needs the header:

Authorization: Bearer <TOKEN>

The token is a personal access token of the user who created it (Profile → API tokens). It works only when:

• the user belongs to a business (store admin or store user) and the account is active,
• the business has an active subscription (or one that is past due),
• the token has not expired or been revoked.

Otherwise the answer is 401, 402 or 403 — see Errors. Every call is logged (method, route, status, duration).

Abilities#

Every token has one or more abilities. An endpoint whose ability the token lacks answers 403.

PATCH /products/{id} with manual_price also needs prices:write.

MCP tokens have separate abilities (mcp, mcp:write) and do not work on the REST API — see MCP.

Rate limits#

The limit is counted per minute, per business (all its tokens together) and depends on the plan:

On top of that, each token can have its own lower limit (set on the Profile page when you create it, or later). Then both limits apply.

Every response carries headers for the tighter limit:

X-RateLimit-Limit: 300
X-RateLimit-Remaining: 287

When it is exceeded the answer is 429 with Retry-After (seconds):

HTTP/1.1 429 Too Many Requests
Retry-After: 42
X-RateLimit-Limit: 300
X-RateLimit-Remaining: 0

{"message": "Πάρα πολλά αιτήματα. Δοκίμασε ξανά σε λίγο."}

Wait as long as Retry-After says before you retry. For many stock changes use the bulk POST /inventory/bulk (up to 500 SKUs per request).

Plan and API limits#

Enabling a product beyond the plan limit answers 422 with errors.enabled = ["plan_limit"].

Error message texts are in Greek. Base your code on the HTTP status and the keys in errors, not on the message text.