> ## Documentation Index > Fetch the complete documentation index at: https://docs.wisepim.com/llms.txt > Use this file to discover all available pages before exploring further. # Agent authentication for WISEPIM > How agents and integrations get WISEPIM credentials: project API keys for the Public API, and the OAuth consent flow Connected Apps use for ChatGPT and Codex. This page follows the [auth.md](https://github.com/workos/auth.md) convention so an agent can read it as a markdown walkthrough at `https://docs.wisepim.com/auth.md`. It describes what exists today, including what is not available, so that nobody has to guess. ## Discover WISEPIM has two ways in, for two audiences: | Audience | Credential | Where it is issued | Endpoint | | - | - | - | - | | Your own code (ERP, storefront, sync job) | **Project API key**, `Authorization: Bearer wpk_...` | By a human, under **Settings > API Access** in the WISEPIM app | `https://wisepim.com/api/public/v1` ([OpenAPI spec](https://docs.wisepim.com/openapi.json)) | | An AI assistant acting for a WISEPIM user | **OAuth 2.0 authorization code with PKCE**, granted on a consent screen in the app | By the user, through [Connected Apps](https://docs.wisepim.com/en/settings/connected-apps.md) | The WISEPIM product MCP server for the assistant | There is no `agent_auth` block, no `identity_endpoint` and no published `/.well-known/oauth-authorization-server` or `/.well-known/oauth-protected-resource` yet. The Public API does not accept OAuth tokens, and the assistant connection is not an open authorization server: today it is available to ChatGPT and Codex. Neither `identity_assertion` (ID-JAG) nor `service_auth` is supported. ## Pick a method * **You run the code and a person can create a key:** use a project API key. This is the method for every integration with the Public API. * **You are an assistant a WISEPIM user wants to connect:** use Connected Apps if you are ChatGPT or Codex. Otherwise ask the user to create a project API key with the scopes you need and hand it to your server-side code. * **You only need documentation:** the docs MCP server at `https://docs.wisepim.com/mcp` needs no credential at all. ## Register Project API keys have no programmatic registration. A **project owner or admin** signs in to the WISEPIM app, opens **Settings > API Access**, clicks **Create API key**, names it and selects scopes: | Scope | Grants | | - | - | | `project:read` | Project name, languages, industry, limits | | `products:read` | Products with attribute values and category ids | | `products:write` | Create products; update content, identifiers, prices, SEO fields, categories, attribute values | | `categories:read` | The category tree | | `attributes:read` | Attribute definitions | Scopes are fixed when the key is created and cannot be widened later. A project holds at most 25 active keys, and one person at most 10 per project. API access depends on the plan; see [pricing](https://docs.wisepim.com/pricing). For Connected Apps, the assistant starts the OAuth request with `response_type=code`, a `code_challenge` (S256), the resource it wants to reach and the scopes it needs. The user is sent to a consent screen in the app that names the assistant and the account, lists each requested permission in plain language, and asks them to choose **exactly one project**. ## Claim A project API key is claimed by the human who created it: the full `wpk_...` value is shown **once**, right after creation. WISEPIM stores only a hash. The key then has to be placed in the integration's secrets manager or environment by a person. A Connected Apps grant is claimed when the user clicks **Allow access** on the consent screen. **Deny access** ends the flow. ## Exchange There is no exchange step for a project API key: the key is the bearer credential, and no refresh token exists. If the key is lost, revoke it and create a new one. For Connected Apps, the assistant exchanges the authorization code for an access token with its PKCE verifier, as in any OAuth 2.0 authorization-code flow. The token is scoped to the one project the user picked and to the approved permissions. ## Use the access\_token Send the key on every request: ```bash theme={null} curl https://wisepim.com/api/public/v1/me \ -H "Authorization: Bearer wpk_..." ``` `GET /me` needs no scope and returns the key's scopes, its rate limit and the bound project, so an agent can verify what it holds before doing anything else. Every other endpoint is listed in the [API reference](https://docs.wisepim.com/en/api-reference/introduction.md). Rate limit: 600 requests per minute per key by default, with `X-RateLimit-Limit`, `X-RateLimit-Remaining` and `X-RateLimit-Reset` on every response. A connected assistant uses its access token against the product MCP server. Reads return data. Every write starts as a proposal that freezes the exact change; by default the assistant applies it within the granted scopes, and when the user switched on approval for the connection, the proposal waits for the user's field-by-field review in WISEPIM before it can be applied. Every preview tells the assistant which policy applies. ## Errors All errors are JSON: `{"error": "...", "code": "...", "request_id": "..."}`. Branch on `code`. | Status | `code` | Meaning | | - | - | - | | `401` | `api_key_required` | Missing `Authorization` header, a value that does not start with `wpk_`, or a revoked or expired key. The response is JSON; there is no `WWW-Authenticate` challenge pointing at resource metadata | | `403` | `insufficient_scope` | The key lacks a scope. `required_scopes` and `missing_scopes` are in the body | | `403` | `issuer_cannot_write` | The person who created the key can no longer edit the project | | `429` | `rate_limited` | Over the per-minute limit. Honour `Retry-After` | ## Revocation * **Project API keys:** a project owner or admin clicks **Revoke** under Settings > API Access. Revocation applies on the next request; nothing is cached. Keys also stop when their creator loses access to the project or is deactivated, and on their expiry date if one was set. * **Connected Apps:** the user opens Settings > Connected apps and revokes the connection. The assistant loses access immediately, and pending proposals expire on their own. ## Related * [Authentication and scopes](https://docs.wisepim.com/en/api-reference/authentication.md) in the API reference * [API Access](https://docs.wisepim.com/en/settings/api.md) and [Connected Apps](https://docs.wisepim.com/en/settings/connected-apps.md) in the settings docs * [Developer portal](https://docs.wisepim.com/developers) This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.