# Rate limits, Appstore listing process, and per-seller API keys for a read-only integration **URL:** \ **Category:** API Queries (How To)\ **Created:** [September 3, 2026, 5:06am UTC](https://developer-forum.veeqo.com/t/rate-limits-appstore-listing-process-and-per-seller-api-keys-for-a-read-only-integration/1717 "2026-09-03T05:06:03Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![tonyzink](https://avatars.discourse-cdn.com/v4/letter/t/9B8BFF/32.png) [@tonyzink](https://developer-forum.veeqo.com/u/tonyzink)\ **Post date:** [September 3, 2026, 5:06am UTC](https://developer-forum.veeqo.com/t/rate-limits-appstore-listing-process-and-per-seller-api-keys-for-a-read-only-integration/1717/1 "2026-09-03T05:06:03Z")
Hi all — building a read-only integration against the Veeqo API and I have three questions the docs don’t cover. Happy to be pointed at existing threads if these have come up. **Context:** my app is an inventory forecasting and production planning tool for small manufacturers. It reads orders, products, warehouses and stock entries to calculate sales velocity and forecast stockout dates. Read-only — no writes back to Veeqo. **1. Rate limits.** I can’t find any documented limits. A single `/orders` page of 100 returns an `X-Runtime` around 11 seconds, so a backfill of ~24,000 orders would be ~240 sequential requests. Is there a documented or practical rate limit I should design around? Is there a recommended pause between pages for a job like this? **2. Appstore listing.** The submission docs cover what’s needed, but not the process. How long does OAuth2 registration usually take after requesting a Client ID and Secret from Support? Is there a review before a listing goes live, and what are the criteria? **3. Per-seller API keys instead of an Appstore listing.** The docs say API keys are for a seller building a private integration for their own business, and that key auth isn’t allowed for new public apps listed on the Appstore. For a small number of pilot customers, is it acceptable for each seller to generate their own API key and connect my app with it — without an Appstore listing — or is OAuth via the Appstore required for any third-party app regardless of scale? Question 3 is the one that most affects my plans, so any steer appreciated. Thanks ---
**Author:** ![Alex-Veeqo](https://yyz1.discourse-cdn.com/flex033/user_avatar/developer-forum.veeqo.com/alex-veeqo/32/416_2.png) [@Alex-Veeqo](https://developer-forum.veeqo.com/u/Alex-Veeqo)\ **Post date:** [September 3, 2026, 9:52am UTC](https://developer-forum.veeqo.com/t/rate-limits-appstore-listing-process-and-per-seller-api-keys-for-a-read-only-integration/1717/2 "2026-09-03T09:52:31Z")
Hi @tonyzink , Thanks for reaching out, I’ll answer your questions. 1. Details on our rate limits can be found on the “[Introduction](https://developers.veeqo.com/getting-started/introduction)” page of the developer documentation. The current limit is **5 requests per second** with a bucket size **up to 100** requests so you should build your integration to this limit. 2. Requesting a Client ID and Secret from support should be a fast process which you can expect to be processed quickly. After you submit your app, the Appstore admin team will usually get back to you within 3 business days - but the timescale after that may vary depending on the complexity of your app. 3. OAuth is required if you wish to have your app listed on the Veeqo app store. You may want to use API keys for testing purposes before the app is listed on the app store. Let me know if this answers your questions and whether you have any further queries. You can also reach out to Veeqo support via the Support Messenger or at [helpme@support.veeqo.com](mailto:helpme@support.veeqo.com) if you want to speak to our team on any specifics. Many Thanks, Alex Veeqo Support ---
**Author:** ![tonyzink](https://avatars.discourse-cdn.com/v4/letter/t/9B8BFF/32.png) [@tonyzink](https://developer-forum.veeqo.com/u/tonyzink)\ **Post date:** [September 3, 2026, 4:25pm UTC](https://developer-forum.veeqo.com/t/rate-limits-appstore-listing-process-and-per-seller-api-keys-for-a-read-only-integration/1717/3 "2026-09-03T16:25:22Z")
Hi Alex, That’s very helpful, thank you — the rate limits and the listing timescales are exactly what I needed, and it’s good to know OAuth credentials and the Appstore listing are separate steps. I’d like to go ahead and register for OAuth. My details: Application name: Gravichart Redirect/callback URI: [https://gravichart.com/oauth/veeqo/callback](https://gravichart.com/oauth/veeqo/callback) Gravichart is an inventory forecasting and production planning tool for small-batch manufacturers. It reads stock levels, warehouses and order history so it can tell a maker when to start their next production run and when to order the materials for it. It doesn’t write anything back to Veeqo. Three things I couldn’t work out from the documentation: 1. Scopes — the example authorize URL in the docs has an empty scope parameter. What scopes are available, and what should I pass for read access to products, stock entries, warehouses, stores and orders? 2. Token lifetime — the token response has no expires\_in and no refresh token. Can I treat the access token as permanent until the seller revokes it, or should I be handling expiry? 3. Testing — is a sandbox or developer test account available? Your point about using an API key for testing is noted, and I’ll do that against my own account. I’d rather build the customer-facing flow on OAuth from the start, since my customers would each need API access enabled on their accounts first. Thanks again, Tony ---
**Author:** ![tonyzink](https://avatars.discourse-cdn.com/v4/letter/t/9B8BFF/32.png) [@tonyzink](https://developer-forum.veeqo.com/u/tonyzink)\ **Post date:** [September 9, 2026, 10:21pm UTC](https://developer-forum.veeqo.com/t/rate-limits-appstore-listing-process-and-per-seller-api-keys-for-a-read-only-integration/1717/4 "2026-09-09T22:21:11Z")
HI @Alex-Veeqo, @Kristien, Following up on my post above from 3 September. I’ve since found answers to two of my three questions in older threads here — the permanent token is confirmed in the original OAuth announcement, and the `state` parameter for CSRF protection is covered in that thread too, though not in the current documentation. That leaves one thing outstanding, and it’s the one I can’t work around: **Could I get the client\_id and client\_secret for OAuth registration?** Application name: Gravichart Redirect/callback URI: [https://gravichart.com/oauth/veeqo/callback](https://gravichart.com/oauth/veeqo/callback) Gravichart is an inventory forecasting and production planning tool for small-batch manufacturers. It reads stock levels, warehouses and order history so it can tell a maker when to start their next production run and when to order the materials for it. It doesn’t write anything back to Veeqo. One smaller question if anyone knows: is there an actual list of OAuth scopes? Every example in the docs and on the forum has `scope=` empty, so I’ve assumed passing it empty is correct — but I’d rather confirm than guess. Thanks, Tony ---
**Author:** ![Alex-Veeqo](https://yyz1.discourse-cdn.com/flex033/user_avatar/developer-forum.veeqo.com/alex-veeqo/32/416_2.png) [@Alex-Veeqo](https://developer-forum.veeqo.com/u/Alex-Veeqo)\ **Post date:** [September 18, 2026, 7:42am UTC](https://developer-forum.veeqo.com/t/rate-limits-appstore-listing-process-and-per-seller-api-keys-for-a-read-only-integration/1717/5 "2026-09-18T07:42:18Z")
Hi @tonyzink , In order to get the client credentials for your OAuth registration, please reach out to Veeqo Support via the Support Messenger or at [helpme@support.veeqo.com](mailto:helpme@support.veeqo.com) as this information is confidential and can’t be shared over a public forum. We can also help you with any further questions you may have to do with the process. Many thanks, Alex Veeqo Support