Rate limits, Appstore listing process, and per-seller API keys for a read-only integration

API Queries (How To)
1

Hi all — building a read-only integration against the Veeqo API and I have three questions the docs don’t cover. Happy to be pointed at existing threads if these have come up.

Context: my app is an inventory forecasting and production planning tool for small manufacturers. It reads orders, products, warehouses and stock entries to calculate sales velocity and forecast stockout dates. Read-only — no writes back to Veeqo.

1. Rate limits. I can’t find any documented limits. A single /orders page of 100 returns an X-Runtime around 11 seconds, so a backfill of ~24,000 orders would be ~240 sequential requests. Is there a documented or practical rate limit I should design around? Is there a recommended pause between pages for a job like this?

2. Appstore listing. The submission docs cover what’s needed, but not the process. How long does OAuth2 registration usually take after requesting a Client ID and Secret from Support? Is there a review before a listing goes live, and what are the criteria?

3. Per-seller API keys instead of an Appstore listing. The docs say API keys are for a seller building a private integration for their own business, and that key auth isn’t allowed for new public apps listed on the Appstore. For a small number of pilot customers, is it acceptable for each seller to generate their own API key and connect my app with it — without an Appstore listing — or is OAuth via the Appstore required for any third-party app regardless of scale?

Question 3 is the one that most affects my plans, so any steer appreciated.

Thanks

2

Hi @tonyzink ,

Thanks for reaching out, I’ll answer your questions.

  1. Details on our rate limits can be found on the “Introduction” page of the developer documentation. The current limit is 5 requests per second with a bucket size up to 100 requests so you should build your integration to this limit.

  2. Requesting a Client ID and Secret from support should be a fast process which you can expect to be processed quickly. After you submit your app, the Appstore admin team will usually get back to you within 3 business days - but the timescale after that may vary depending on the complexity of your app.

  3. OAuth is required if you wish to have your app listed on the Veeqo app store. You may want to use API keys for testing purposes before the app is listed on the app store.

Let me know if this answers your questions and whether you have any further queries. You can also reach out to Veeqo support via the Support Messenger or at helpme@support.veeqo.com if you want to speak to our team on any specifics.

Many Thanks,
Alex
Veeqo Support

3

Hi Alex,

That’s very helpful, thank you — the rate limits and the listing timescales are exactly what I needed, and it’s good to know OAuth credentials and the Appstore listing are separate steps.

I’d like to go ahead and register for OAuth. My details:

Application name: Gravichart
Redirect/callback URI: https://gravichart.com/oauth/veeqo/callback

Gravichart is an inventory forecasting and production planning tool for small-batch manufacturers. It reads stock levels, warehouses and order history so it can tell a maker when to start their next production run and when to order the materials for it. It doesn’t write anything back to Veeqo.

Three things I couldn’t work out from the documentation:

  1. Scopes — the example authorize URL in the docs has an empty scope parameter. What scopes are available, and what should I pass for read access to products, stock entries, warehouses, stores and orders?

  2. Token lifetime — the token response has no expires_in and no refresh token. Can I treat the access token as permanent until the seller revokes it, or should I be handling expiry?

  3. Testing — is a sandbox or developer test account available? Your point about using an API key for testing is noted, and I’ll do that against my own account. I’d rather build the customer-facing flow on OAuth from the start, since my customers would each need API access enabled on their accounts first.

Thanks again,
Tony