Skip to main content

API Changelog

Notable changes to the API surface and this documentation. Dates are UTC.

2026-09-06​

  • New: OAuth 2.1 for the MCP server — dynamic client registration, PKCE (S256 only), rotating refresh tokens with replay detection, and a merchant consent page. An assistant can now connect to a store without anyone handling an API key, and merchants revoke connections from Settings → MCP.
  • New: ChatGPT connects as a developer-mode custom connector over OAuth; setup for Codex CLI documented.
  • Docs: two builder tools were missing from the Tool Reference — builder_get_theme_schema and builder_create_menu. The server exposes 33 tools, not 31.
  • Docs: corrected the blanket "builder writes only ever stage drafts" claim — builder_create_menu creates new menus live, because menus aren't revisioned.
  • Known limitation: get_review_summary needs the REVIEWS scope, which no OAuth scope grants; it is reachable with an API key only.

2026-07-27​

  • New: the MCP Server — a Model Context Protocol endpoint at POST /mcp that lets an AI assistant read store data with an API key. 12 read-only tools; see the Tool Reference.

2026-07-02​

  • Docs: corrected documented paths — staff endpoints live at /staff (previously documented as /user), order cancellation is POST /order/vendor/cancel/{orderId}, order detail is GET /order/details/{orderId}, order list is GET /order/vendor.
  • Docs: authentication guide now covers both tt-api-key and Authorization: Bearer headers, the real scope model (resource + action pairs), and the full authentication error table.
  • Docs: new pages — Webhooks, Scopes Reference, Environments.
  • Docs: rate-limit documentation corrected: default 140 requests/60s sliding window; X-RateLimit-Reset is seconds-until-free, not a timestamp.