API reference
Common headers
Four headers cover almost every call. Get Origin and the cookie right, and auth stops being mysterious.
The login call is the strict one: Origin must match a registered storefront exactly, including scheme and port. Refresh never reads a body — only the refreshToken cookie. Every JSON POST or PUT needs Content-Type: application/json.
Body fields
Originstringrequired
Required on login. Must match AllowedOrigin.origin exactly.
AuthorizationBearerrequired
Required on every call except login and refresh.
CookierefreshTokenoptional
Required on refresh. Read from the cookie only, never from the body.
Content-Typeapplication/jsonoptional
Required on every POST and PUT.
Originstring required | Required on login. Must match AllowedOrigin.origin exactly. |
AuthorizationBearer required | Required on every call except login and refresh. |
CookierefreshToken optional | Required on refresh. Read from the cookie only, never from the body. |
Content-Typeapplication/json optional | Required on every POST and PUT. |