Partner Authorization

• Prerequisites: Partner authorization layer protects the Partner's data on the Keep domain against unauthorized access and mutation.
• Authorization Flow: Keep uses OAuth 2.0 client credentials. POST /oauth2/token (form-encoded) with grant_type=client_credentials, client_id, client_secret and optional scope (partner-api or seller-api); send Authorization: Bearer <access_token>; refresh with grant_type=refresh_token. Use the lifetime returned in expires_in; when supplied, refresh_expires_in gives the refresh-token lifetime. Keep is served on https://<partner_domain>.keep.co.il; HTTPS only. Credentials come from your Account Manager and cannot be rotated by you.