comecerodocs
Settings

Update technical settings

POST
/settings/technical

Changes the technical settings. Send only the fields you want to change. Changing app_hosts changes where your shop answers. Settings are kept per mode: a test token works on the test settings, a live token on the live ones. Secret and trusted tokens may call it when their permissions include settings_technical. Limited tokens may not.

Authorization

headerAuthorizationBearer <token>

A secret, trusted or limited token. See Authentication.

Query Parameters

show?string

Comma-separated fields to return; all others are left out. Use dot notation for child fields (customer.email). You cannot send show and hide together (400). See Customizing output.

hide?string

Comma-separated fields to leave out of the response. Use dot notation for child fields (customer.email). You cannot send show and hide together (400). See Customizing output.

formatted?boolean

When true, the object also has a formatted child with amounts and dates as display text in the shopper's language and currency (for example $19.99 or November 7, 2026). The default is false. See Localized formatting.

Defaultfalse

Request Body

application/json
  1. body

The technical fields to change. Send only the fields you want to change. Lists you send replace the saved list.

Properties1 <= properties
timezone?|

An IANA time zone name.

app_hosts?array<string>

Between 1 and 3 host names; the first is the default. A host another account uses returns 409. After 10 changes, further changes return 400.

Items1 <= items <= 3
app_alias_redirects?|

Alias redirects. An alias may not point to itself.

signature_key?|

Letters and digits only, up to 64.

Match^[A-Za-z0-9]*$
Lengthlength <= 64
oauth_redirect_uris?array<>|

Fully qualified addresses, including http:// or https://.

Itemsitems <= 20
cors_allowed_origins?array<string>|

Scheme and host only. https in live mode.

Itemsitems <= 15
allow_public_limited_test_tokens?boolean

Let anyone get a limited test token for the account.

Response Body

The technical settings, after the change.

application/json
  1. response

Technical settings of the account in the current mode: time zone, shop addresses, the webhook signing key, OAuth redirect addresses and CORS.

object?"settings_technical"

The object type. Always settings_technical.

Value in"settings_technical"
url?string

The URL of this object.

Formaturi
account_id?string

The ID of the account the settings belong to.

test?boolean

True for the test mode settings, false for live.

date_modified?string

When the settings were last changed.

Formatdate-time
timezone?|

The time zone for reports and dates, as an IANA name such as America/New_York. null uses UTC.

app_hosts?array<string>

The host names your shop answers on, up to 3. The first is the default. After 10 changes, contact support to change them again.

Items1 <= items <= 3
app_alias_redirects?|

Send requests for one app alias to another, as an object of old alias to new alias, such as {"old-cart": "cart"}.

signature_key?|

The key Comecero signs outbound requests with (webhook events and license service calls), so you can check they came from Comecero. Letters and digits only, up to 64. Keep it secret.

Lengthlength <= 64
oauth_redirect_uris?array<>

The redirect addresses allowed for OAuth sign-in to your apps. Up to 20.

Itemsitems <= 20
cors_allowed_origins?array<string>

Web origins allowed to call the API from a browser, up to 15. Scheme and host only, such as https://www.example.com, with no trailing slash. Live mode needs https; test mode allows http too.

Itemsitems <= 15
allow_public_limited_test_tokens?boolean

Let anyone get a limited test mode token for this account without first holding one of your tokens.

formatted?

Display text for the dates. Returned only when formatted=true.

Example Request
curl -X POST 'https://api.comecero.com/api/v1/settings/technical' \  -H 'Content-Type: application/json' \  -d '{  "cors_allowed_origins": [    "https://www.example.com",    "https://shop.example.com"  ]}'
Example Response
{  "object": "settings_technical",  "url": "https://api.comecero.com/api/v1/settings/technical",  "account_id": "AB1234",  "test": true,  "date_modified": "2026-10-02T14:21:07Z",  "timezone": "America/New_York",  "app_hosts": [    "example.apps.comecero.com"  ],  "app_alias_redirects": null,  "signature_key": "7f3K9pQx2LmN8vB4",  "oauth_redirect_uris": [    "https://www.example.com/oauth/callback"  ],  "cors_allowed_origins": [    "https://www.example.com"  ],  "allow_public_limited_test_tokens": false}

Get technical settings GET

Returns the time zone, shop host names, app alias redirects, the signing key for webhooks, OAuth redirect addresses and CORS origins. The response holds your signing key: call it from your server only. Settings are kept per mode: a test token works on the test settings, a live token on the live ones. Secret and trusted tokens may call it when their permissions include `settings_technical`. Limited tokens may not.

Overview

Next Page