Change the shop's web address and/or connect its own domain
- Credentials
- OAuth access token
- Scopes
settings:write- Role
- Owners and admins only. Staff get
403 forbidden. - Subscription
- Needs an active plan. Otherwise
403 subscription_locked. - Idempotency
- Send an
Idempotency-Keyheader. A retry with the same key does the work once.
Moves the ShopEazy address (address) and/or connects the merchant's own domain (customDomain; an empty one disconnects it). Only what is sent changes. A taken address is refused with the closest free one (422 validation_error); a custom domain needs the add-on, included on Growth (403 plan_limit).
Connecting a domain attaches it (and its www/apex twin) to the storefronts project and to the sign-in domains, then checks its DNS: domainState says whether it is live and records what to create at the registrar until it is. Buying a domain is done elsewhere.
Access: OAuth scope settings:write; owner/admin only; write-gated by the subscription.
merchantOAuth settings:writeAuthorizationBearer <token>OAuth 2.1 (authorization code + PKCE S256, public clients, dynamic registration) for connected AI apps. Effective power is scopes granted AND the person's role today AND the plan. orders:refund, billing:write and team:write are opt-in on the consent screen. Write implies read for marketing:read and messages:read, so a grant holding marketing:write passes a marketing:read check, and messages:send passes messages:read.
Scope: settings:write
storeId*stringA store the person can reach. Any other id answers 404, never 403.
Idempotency-Key*stringRequired on every write. Minted on the device when the person taps, reused on every retry. A write without one, or with one that does not match the pattern, is refused with 422 validation_error. Scoped to the token's subject, remembered 24 hours. A replay returns the first 2xx response with Idempotent-Replay: true; a request still running answers 409 in_flight; the same key with a different method, path or body answers 409 idempotency_key_reused; non-2xx results are not remembered. If the key store cannot be read nothing is processed and the answer is 503 idempotency_unavailable: retry with the same key.
^[A-Za-z0-9_-]{8,128}$application/json- body
address?stringThe part before .shopeazy.co.
1 <= length <= 63customDomain?stringThe merchant's own domain. Empty disconnects it.
length <= 253OK
application/json- response
data*curl -X PUT 'https://api.shopeazy.co/v1/merchant/stores/<storeId>/web-address' \ -H 'Authorization: Bearer <access_token>' \ -H 'Idempotency-Key: <unique_key>' \ -H 'Content-Type: application/json' \ -d '{}'{ "data": { "address": "string", "subdomain": "string", "customDomain": "string", "domainState": "string", "records": [ { "type": "CNAME", "host": "string", "value": "string" } ], "liveUrl": "string", "check": { "subdomain": "string", "address": "string", "free": true, "reason": "string", "suggestion": "string" }, "changed": true }}The shop's web address and where a connected domain is at GET
The ShopEazy address, the merchant's own domain if one is connected, and what to create at their registrar until it is live. With `name`, also answers whether that ShopEazy address is free (same policy and availability as `checkWebAddress`, and the closest free one when it is not), so a change can be shown before it is made. Access: OAuth scope `settings:write`; owner/admin only; not write-gated.
The shop's ad and analytics tags PATCH
Meta pixel ID (digits), Google Analytics ID (G-...), Google site verification and Google Ads (AW-... or AW-.../label). Loaded on every shop page, so anything that is not exactly an ID is refused. A key left out keeps the stored tag; null or an empty string removes it. Answers with all four as saved. Access: OAuth scope `settings:write`; owner/admin only; write-gated by the subscription.