Guides

Authentication

Every request carries an API key as a bearer token.

Header

Authorization: Bearer tcn_live_<8>_<40>

curl

curl "https://api.comnethub.app/v1/developer/token-info" \
  -H "Authorization: Bearer $THECOMNET_API_KEY"

Two ways to authenticate

Method	Use when	Token
API key	Your own systems access your own tenant.	`tcn_live_…`
OAuth app	Your product acts for other merchants, who each approve it.	`tcn_at_…`

Both are sent as Authorization: Bearer … and use the same endpoints and scopes. This page covers API keys; see Build an app (OAuth 2.0) for apps.

API keys

Format: tcn_live_ + 8 alphanumeric characters + _ + 40 alphanumeric characters. The first 17 characters (tcn_live_XXXXXXXX) are a public prefix shown in the console to tell keys apart.
The full key is shown once, when it is created. TheComNet stores only a SHA-256 hash, so a lost key cannot be recovered: revoke it and create a new one.
Keys are created by an owner or admin under Pengaturan → Integrasi and belong to one tenant. Every call is scoped to that tenant's data.
A key acts as its creator. It stops working as soon as that member is removed from the tenant, deactivated, or demoted below admin. Create integration keys from an account that will stay owner/admin.
Keep keys server-side. Never ship them in browser or mobile apps, and never commit them.

Revocation and expiry

A key can be revoked at any time in the console. Revocation takes effect on the next request.
A key can carry an optional expiry date, set when it is created. After that moment it no longer authenticates.
Revoked, expired, malformed, or unknown keys, and keys whose creator lost access, all answer 401 API_KEY_INVALID. The response does not say which; check the key in the console.

Scopes

A key carries one or more scopes chosen at creation. Each operation lists the scopes that unlock it; holding any of them is enough. A :write scope does not imply :read, so grant both when the integration reads and writes.

Scope	Covers	Operations
`orders:read`	Orders, order detail, shipping options and labels, after-sales requests and reject reasons, pick/pack lists.	7
`orders:write`	Arrange shipment (single and bulk), approve or reject after-sales requests, bulk pick/pack.	4
`products:read`	Synced products, inventory items, warehouses, stock and movements, marketplace catalog (categories, attributes, brands, warehouses, product drafts).	13
`products:write`	Create and edit inventory items, adjust and push stock, link variants, stock documents, bulk price/stock, catalog images and products.	10
`contacts:read`	Contacts, contact detail, and contact labels.	3
`contacts:write`	Rename, label, or annotate contacts.	1
`chat:read`	Conversations, messages, chat labels, and quick replies.	4
`chat:write`	Send replies, add internal notes, update conversations, mark read.	4

3 operations accept any key regardless of scopes: GET /v1/stores, GET /v1/stores/{storeId}, GET /v1/developer/token-info. Operations that are not in the API reference are console-only and refuse API keys.

Authentication errors

Status	Code	Meaning
401	`UNAUTHENTICATED`	No Authorization header.
401	`API_KEY_INVALID`	Unknown, malformed, revoked, or expired key, or its creator is no longer an active owner/admin.
403	`API_KEY_NOT_ALLOWED`	The operation is console-only and does not accept API keys.
403	`API_SCOPE_MISSING`	The key has none of the scopes the operation requires.
403	`FEATURE_NOT_IN_PLAN`	The tenant is not on a plan with API access (Pro). details.feature is "api_access".

403 application/problem+json

{
  "type": "about:blank",
  "title": "API_SCOPE_MISSING",
  "status": 403,
  "code": "API_SCOPE_MISSING",
  "detail": "API key lacks the required scope",
  "instance": "/v1/orders",
  "details": {
    "required": [
      "orders:read"
    ]
  },
  "requestId": "6f1c2d3e-4b5a-4c6d-8e7f-90a1b2c3d4e5"
}