Authentication & scopes

Send Authorization: Bearer <token> on every request to https://app.tryedison.com/api/v1. One key maps to one shop — there is no cross-shop access.

Key types

• ed_live_… — production REST and MCP access for live integrations.
• ed_test_… — same API surface in test mode (recommended while building).

Keys are minted in Settings → API / Agent. Revoking or rotating a key disconnects every client that still holds the old token.

Read vs write

When you create a key, pick read or write. Read keys cannot PATCH shop settings, approve jobs, or manage webhooks. Write keys can, subject to scopes.

Scopes

Write keys include the scopes you select at creation time. Each route checks scopes:

• calls:read
• transcripts:read
• jobs:read
• jobs:write
• settings:read
• settings:write
• usage:read
• webhooks:write

Missing scope → 403 with code: "forbidden_scope". Read key on a write route → code: "read_only".

MCP

Shop API keys (ed_live_ / ed_test_) also authenticate MCP at https://app.tryedison.com/api/mcp. The separate ed_me_ agent token from the same settings page is for owner agents (ChatGPT, Claude, Cursor) with the same shop-only tools.