Start here
Authentication
Bearer tb_cus_ on every call. One shop. Rotate to disconnect.
Every call except GET /openapi.json needs Authorization: Bearer tb_cus_…. The token is bound to one shop. It cannot search another account.
Where to get it
Settings → API and Settings → ChatGPT & Claude issue the same key. Rotate once, both disconnect.
Authorization: Bearer tb_cus_…A 401 is almost always the token
Missing header, a truncated paste, or a key you already rotated. Response body is { "error": "…", "code": "unauthorized" }.