generated: '2026-08-02'
method: searched
source: openapi/back-market-openapi-original.yml
docs: https://api.backmarket.dev/#technical-requirements
description: >-
  Back Market's seller API is authenticated with a single opaque token generated by the
  seller in the Back Office (Integrations option page) and sent on every request as
  `Authorization: Basic <token>`. The OpenAPI models this twice — once as an apiKey scheme
  on the Authorization header and once as HTTP basic — and applies both, as alternatives,
  to every operation. There is no OAuth 2.0, no OpenID Connect, no scopes, no refresh flow
  and no mTLS: the token is a bearer-equivalent long-lived secret scoped to the seller
  account and to one platform (production or preprod, per region).
summary:
  types:
  - apiKey
  - http
  api_key_in:
  - header
  oauth2_flows: []
  scopes: none — Back Market publishes no scope or permission model
schemes:
- name: ApiKeyAuth
  type: apiKey
  in: header
  parameter: Authorization
  description: |-
    Token authentication is done with Basic authentication.
    Prefix the value with "Basic" and use the token you created in the backoffice in the Integrations option page.
  sources:
  - openapi/back-market-openapi-original.yml
- name: BasicAuth
  type: http
  scheme: basic
  sources:
  - openapi/back-market-openapi-original.yml
application:
  operations_secured: 39
  operations_total: 39
  pattern: 'security: [{ApiKeyAuth: []}, {BasicAuth: []}] declared per operation'
token:
  issuance: seller Back Office → Integrations option page
  format: opaque; sent verbatim after the literal prefix "Basic "
  expiry: none published
  rotation: >-
    Third-party integrator documentation reports that changing the Back Office password
    invalidates the token and a new one must be issued; Back Market's own API Guidelines do
    not document a rotation or expiry policy.
  environment_scope: >-
    A token is valid only on the platform where it was created — production and preprod are
    separate accounts, and the EU / NA / AP platforms are separate as well.
companion_headers:
- name: Accept-Language
  required: true
  purpose: selects the marketplace country the authenticated call reads or writes
- name: User-Agent
  required: true
  purpose: >-
    Identifies the integrator as BM-{CompanyName}-{IntegrationName};company@companydomain.com.
    Mandatory — requests without it may be refused by the platform.
edge_controls:
  waf: Cloudflare
  bot_management: >-
    Protected endpoints can answer 403 with an ErrorResponseV2 body carrying the code
    bot-need-challenge and a challengePath; capture cf-ray and escalate.
gaps:
- no OAuth 2.0 / OpenID Connect (no /.well-known/openid-configuration on any host)
- no scopes or least-privilege token model — one token grants the full seller surface
- no documented token expiry, rotation cadence, or revocation endpoint
- no mutual TLS or IP allow-listing documented