API reference

Authentication

• Merchant admin APIs require a valid NextAuth session (cookie-based) for platform users.
• Storefront customers sign in via NextAuth (same session cookie as the platform, scoped per host). Subdomain requests authenticate against the store customer table.
• Store context is passed via the x-store-subdomain header or subdomain query parameter on storefront routes.

Storefront — catalog & CMS

• GET /api/storefront/catalog — resolve store, branding, and homepage data.
• GET /api/storefront/products/search — search and filter products.
• GET /api/storefront/cms/pages — list CMS pages.
• GET /api/storefront/cms/blog — list blog posts.

Storefront — cart & checkout

• GET/POST/PATCH/DELETE /api/storefront/cart — manage cart lines.
• POST /api/storefront/cart/estimate — shipping and totals estimate.
• GET /api/storefront/checkout/options — shipping methods and checkout config.
• POST /api/storefront/checkout/place-order — submit an order.
• POST /api/storefront/checkout/track-order — guest order lookup by email + order number.

Storefront — customers

• POST /api/storefront/customer/register — create a store customer account.
• POST /api/auth/signin — customer sign-in on store subdomain (NextAuth credentials + subdomain).
• POST /api/storefront/customer/sync-session — merge guest cart after sign-in.
• GET /api/storefront/customer/me — profile, addresses, and orders.
• POST /api/storefront/customer/check-email — validate email availability for the store.

Merchant admin (authenticated)

• Products: /api/owner-products/* — CRUD, status, and media.
• Orders: /api/owner-orders/* — fetch, update status, fulfillment.
• Customers: /api/owner-customers/* — list and manage store customers.
• Store settings: /api/store-settings/*, /api/store-branding/*.
• Plans & billing: /api/stripe/*, /api/plans/*.

Conventions

• JSON request and response bodies unless noted otherwise.
• Standard HTTP status codes; errors return { message: string }.
• Pagination uses page and limit query parameters where supported.
• Rate limits apply to public endpoints to prevent abuse.

Need more?

Full OpenAPI documentation and webhooks are on the roadmap. For integration support, contact [email protected] with your use case.