Triple Whale offers two ways to call the API. Pick the one that matches who owns the integration.

	API key	OAuth app (Developer Portal)
Who creates it	A merchant, for their own shop, on the API Keys page in the Triple Whale app	A developer, in the Developer Portal, after review
Who it acts for	The user who created it, on that shop	Any merchant who connects the app, on the shops they grant
Credential	`x-api-key` header	`client_id` and client secret, then a bearer access token with refresh
Review	None. The key is created immediately.	Triple Whale reviews the app before credentials are issued
Where the merchant sees it	The API Keys page (prefix, description, scopes, last call)	Apps & Extensions, with your name and logo
Best for	Scripts, BI pipelines, and internal tools for one company	Products and integrations sold to many Triple Whale merchants

Scopes

API key scopes are listed in Creating and Managing Triple Whale API Keys. OAuth app scopes are a shorter list, documented in OAuth Scopes. An OAuth app cannot request every API key scope. Orders and similar Data-In writes are available on an API key, not on an OAuth app. Email and SMS writes use the OAuth scope email-sms:write.

The Developer Portal does not create API keys. Keys are created in the Triple Whale app.

📘
Keys Follow the User
API keys are tied to the user who created them. If that user is removed from the shop, their keys stop working. OAuth app connections belong to the shop and stay in place when staff change.

When to Move from an API Key to an OAuth App

You are asking more than one Triple Whale customer to paste a key into your product.
You need merchants to grant several shops at once.
You want the integration listed by name and logo in the merchant's Apps & Extensions.

Submit the app in the portal. See Submitting an App for Review.