> ## Documentation Index > Fetch the complete documentation index at: https://spreecommerce.org/docs/llms.txt > Use this file to discover all available pages before exploring further. # Discover the authorization server > RFC 9728. A client given a URL it cannot reach unauthenticated reads this to learn which authorization server guards it and which permissions that server accepts. Unauthenticated by design: a client has to read it before it holds anything. ## OpenAPI ````yaml /api-reference/admin.yaml get /api/v3/oauth/protected-resource/{resource_key} openapi: 3.0.3 info: title: Admin API contact: name: Spree Commerce url: https://spreecommerce.org email: hello@spreecommerce.org description: > Spree Admin API v3 - Administrative API for managing products, orders, and store settings. ## Authentication The Admin API requires a secret API key passed in the `x-spree-api-key` header. Secret API keys can be generated in the Spree admin dashboard. ## Response Format All responses are JSON. List endpoints return paginated responses with `data` and `meta` keys. Single resource endpoints return a flat JSON object. ## Resource IDs Every resource is identified by an opaque string ID (e.g. `prod_86Rf07xd4z`, `variant_k5nR8xLq`, `or_UkLWZg9DAJ`). Use these IDs everywhere — URL paths, request bodies, and Ransack filters all accept them directly. ## Error Handling Errors return a consistent format: ```json { "error": { "code": "validation_error", "message": "Validation failed", "details": { "name": ["can't be blank"] } } } ``` version: v3 servers: - url: http://{defaultHost} variables: defaultHost: default: localhost:3000 security: [] tags: - name: Authentication description: Admin user login, logout, token refresh, and current user profile - name: Allowed Origins description: CORS allowlist for storefront and admin client origins - name: API Keys description: Secret and publishable API keys - name: Categories description: >- Hierarchical product categories — tree management, repositioning, and product assignments - name: Channels description: >- Sales channels, product publication across channels, and per-channel order routing rules - name: Custom Fields description: >- Custom field definitions for products, variants, customers, and other resources - name: Customer Groups description: >- Customer groups for segmenting customers (e.g. wholesale, VIP) used by pricing and promotions - name: Customers description: Customer profiles, addresses, credit cards, and store credits - name: Email Templates description: >- Customer email templates, the email layout and shared partials: drafts, previews, publishing and history - name: Exports description: Async CSV exports of admin resources - name: Files description: Uploading the files that product media, imports, logos and documents use - name: Fulfillments description: Order fulfillments — shipments, fulfill, cancel, resume, split - name: Gift Cards description: Gift cards and gift card batches - name: Imports description: >- Async CSV imports of admin resources, with per-row status and failed-row retry - name: Markets description: >- Markets — geographic groupings of countries used for pricing, tax, and fulfillment rules - name: Option Types description: >- Option types and option values used to build product variants (e.g. Size, Color) - name: Orders description: Orders, order items, applied gift cards, and applied store credits - name: Payment Methods description: Configured payment providers and their available types - name: Payments description: Order payments — list, capture, void - name: Pricing description: >- Prices and price lists for currency-, market-, and customer-group-specific pricing - name: Products description: >- Products, taxons/categories, product custom field values, and bulk product operations - name: Policies description: The store's legal documents — terms of service, privacy, returns, shipping - name: Reasons description: >- Merchant-owned vocabularies for why a return, claim, refund, cancellation or tax exemption happened - name: Promotions description: Promotions, promotion rules, promotion actions, and coupon codes - name: Refunds description: Order refunds - name: Settings description: Store-level settings — store profile, tags, and configuration - name: Staff description: Admin users, roles, and invitations to the store - name: Stock Locations description: Warehouses and physical fulfillment locations - name: Store Credits description: Prepaid customer balances across all customers, and each balance's ledger - name: Variants description: >- Product variants — the individual SKUs (size/color combinations) sold under a product - name: Webhooks description: Webhook endpoints and webhook delivery history paths: /api/v3/oauth/protected-resource/{resource_key}: parameters: - name: resource_key in: path required: true description: Which protected surface, e.g. `mcp` schema: type: string get: tags: - OAuth summary: Discover the authorization server description: | RFC 9728. A client given a URL it cannot reach unauthenticated reads this to learn which authorization server guards it and which permissions that server accepts. Unauthenticated by design: a client has to read it before it holds anything. responses: '200': description: metadata content: application/json: example: resource: http://www.example.com/api/v3/admin/mcp authorization_servers: - http://www.example.com scopes_supported: - read_dashboard - read_reports - write_reports - read_orders - write_orders - read_payments - write_payments - read_fulfillments - write_fulfillments - read_refunds - write_refunds - read_products - write_products - read_product_types - write_product_types - read_publishing - write_publishing - read_media - write_media - read_categories - write_categories - read_collections - write_collections - read_stock - write_stock - read_purchasing - write_purchasing - read_customers - write_customers - read_sellers - write_sellers - read_commissions - write_commissions - read_payouts - write_payouts - read_gift_cards - write_gift_cards - read_store_credits - write_store_credits - read_promotions - write_promotions - read_settings - write_settings - read_delivery_methods - write_delivery_methods - read_package_types - write_package_types - read_email_templates - write_email_templates bearer_methods_supported: - header resource_documentation: https://spreecommerce.org/docs/developer/mcp/overview schema: $ref: '#/components/schemas/OauthProtectedResource' '404': description: no such protected surface x-codeSamples: - lang: javascript label: Spree Admin SDK source: >- import { createAdminClient } from '@spree/admin-sdk' const client = createAdminClient({ baseUrl: 'https://your-store.com', secretKey: 'sk_xxx', }) const response = await fetch('https://your-store.com/api/v3/oauth/protected-resource/admin') const metadata = await response.json() - lang: bash label: Spree CLI source: spree api get /api/v3/oauth/protected-resource/{resource_key} components: schemas: OauthProtectedResource: type: object properties: resource: type: string authorization_servers: type: array items: type: string scopes_supported: type: array items: type: string bearer_methods_supported: type: array items: type: string resource_documentation: type: string required: - resource - authorization_servers - scopes_supported - bearer_methods_supported - resource_documentation x-typelizer: true ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.