Browse the docs ▾

Get started

Sign-in and permissions

AI apps sign in with your Opmiz account. You choose the businesses and what the app may do, and you can take it back at any time.

How sign-in works

When you connect an app, your browser opens Opmiz. You sign in, tick the businesses the app may use, and see each permission in plain words before you allow it. The app never sees your password.
Under the hood this is OAuth 2.1 with PKCE. Apps can register themselves (dynamic client registration) or use a client ID metadata document, so there is nothing to set up with us first.

Authorization server

https://mcp.opmiz.com

Discovery

/.well-known/oauth-authorization-server and /.well-known/oauth-protected-resource

Access token

Lasts 1 hour. The app refreshes it on its own.

Refresh token

Lasts 30 days and changes every time it is used. Removing the app ends it at once.

Permissions

An app gets every permission below unless you untick it on the sign-in page. It can never do more than you can do yourself in the dashboard, so your role in a business still applies.

PERMISSION

LETS AN APP

site:read

See your sites, pages, business details and Terms and Privacy.
Roles: Owner, Admin, Account Manager, Marketing

site:write

Edit the site's draft design and set the logo.
Roles: Owner, Admin, Account Manager

site:publish

Publish the site. Save page settings, business details, Terms and Privacy, and the shop's lists.
Roles: Owner, Admin, Account Manager

content:read

Read content types, items, tags and the Library.
Roles: Owner, Admin, Account Manager, Marketing

content:write

Write content drafts and run imports.
Roles: Owner, Admin, Account Manager, Marketing

content:publish

Publish and take down content, and save Library items.
Roles: Owner, Admin, Account Manager, Marketing

content:schema

Change a content type's fields and custom types.
Roles: Owner, Admin

media:write

Add images to your media.
Roles: Owner, Admin, Account Manager, Marketing

catalogue:read

See products, stock, collections and categories.
Roles: Owner, Admin, Account Manager, Category Manager

catalogue:write

Add products, archive them, arrange collections and fill category fields.
Roles: Owner, Admin, Account Manager

orders:read

See orders.
Roles: Owner, Admin, Account Manager

orders:fulfil

Mark orders ready to ship, shipped and delivered.
Roles: Owner, Admin, Account Manager
Tools for a permission you didn't give simply don't appear in the app. If an app connected before 25 October 2026 is missing the product, order or content-field tools, clear its sign-in and connect again.

API keys

Scripts use an API key instead of signing in. An Owner or Admin creates one in Settings › AI apps and sees it once. Each key works on one business, acts as the person who made it, and lasts 90 days; Opmiz reminds you 14 days before it ends and you can renew it. Keys can't have the order, product-writing or content-field permissions. See REST API.

Protected resource metadata

GET https://mcp.opmiz.com/.well-known/
    oauth-protected-resource

{
  "resource": "https://mcp.opmiz.com/mcp",
  "authorization_servers": [
    "https://mcp.opmiz.com"
  ],
  "scopes_supported": [
    "site:read", "site:write",
    "site:publish", "content:read",
    "content:write", "content:publish",
    "content:schema", "media:write",
    "catalogue:read", "catalogue:write",
    "orders:read", "orders:fulfil"
  ]
}