Token Types

Secret Admin Token

Scope: Full administrative access to a brand's data.

Safety: Server-side only. Never expose in client code.

Use cases: Backend services, admin dashboards (server-rendered), data migrations.

import { Threeu } from "threeu-sdk";

const threeu = new Threeu(process.env.THREEU_SECRET_KEY);
const brand = await threeu.brand("my-store");
const orders = await brand.orders.list();

Public Storefront Token

Scope: Read-only access to published products, collections, and brand settings.

Safety: Safe for browser/client-side use.

Use cases: Storefront themes, product pages, cart operations.

import { ThreeuStorefront } from "threeu-sdk/storefront";

const storefront = new ThreeuStorefront({ publicToken: "pk_live_abc123", brand: "my-store" });
const products = await storefront.products.list();

Other Token Types

Plugin Installation Token — Server-side only. Scoped to the permissions declared in the plugin manifest and approved during installation. Each brand installation generates a unique token.

POS Token — Device-only. Scoped to point-of-sale operations including cart, checkout, payments, and receipts.

Theme Development Token — Safe for local dev environments. Provides read access for theme preview.

Developer API Token — Server-side and Developer Dashboard only. Used for CI/CD pipelines and automated plugin management.