Getting Started

Authentication

OAuth 2.0 client-credentials

Every service in this reference authenticates with OAuth 2.0 client-credentials. You’ll see one of two named security schemes on a given operation, depending on which service you’re calling:

  • walletAuth — used by most services (Orders, Catalog Items, Inventory, Feeds, Reports, Sellers, and others).
  • sellerAuth — used by Authorization, the fulfillment-inbound family, Pricing, Product Fees, Sales, and Seller Communications. This scheme traces back to these services’ shared origin as adapted SP-API contracts.

Both flow through the same token endpoint shape — request a token with your client ID and secret, then send it as a bearer token on subsequent calls:

curl -X POST https://marketplace.walmart.com/seller/v1/auth/token \
  -d grant_type=client_credentials \
  -d client_id=$WALMART_SELLER_CLIENT_ID \
  -d client_secret=$WALMART_SELLER_CLIENT_SECRET
curl https://marketplace.walmart.com/seller/v1/orders/v4/orders \
  -H "Authorization: Bearer $ACCESS_TOKEN"

Sensitive data (RDTs)

A handful of Payments operations are flagged x-walmart-pii: true because they return order- or seller-level PII. Those additionally require a Restricted Data Token (RDT) issued by the Tokens service before they’ll return data in production — a plain access token isn’t sufficient on its own for those routes.