Customer API

​

The Customer API or an API key

​

Signing a buyer in

1. The buyer types their email address. Send a sign-in code emails them six digits, in your store’s name.
2. They type the code. Sign in with the code answers their token.
3. Every other request sends it: Authorization: Bearer shoply_ct_....

const api = "https://api.shoply.gg/v1/stores/YOUR_STORE_ID/customer";
const json = { "Content-Type": "application/json" };

// 1. The code, to the address they typed.
await fetch(`${api}/login`, { method: "POST", headers: json, body: JSON.stringify({ email }) });

// 2. The code they typed, for their token.
const signedIn = await fetch(`${api}/verify`, {
  method: "POST",
  headers: json,
  body: JSON.stringify({ email, code }),
}).then((res) => res.json());

const token = signedIn.data.token;

// 3. Their orders.
const buyer = await fetch(api, { headers: { Authorization: `Bearer ${token}` } }).then((res) => res.json());

​

What the answer says about an address

​

Keeping the token

• It works for 30 days from sign-in, then the buyer signs in again. Using it does not make it last longer.
• Keep it where only your page or app can read it: in memory, or your app’s own secure storage. Never put it in an address, where it ends up in logs and in what the browser tells the next site.
• A buyer holds 20 tokens at your store at most. Signing in a 21st time ends their oldest.
• Sign out ends the token the request is made with. Sign out everywhere ends every token they hold at your store, and signs them out of its customer panel.

​

What a token reaches

• What your settings switch off is refused here too: an affiliate programme that is off, payouts you do not allow, cancelling or pausing that you do not let buyers do.
• An order’s keys and files are left out while you hold them back: a subscription that ended or is paused, or a payment that is disputed where you take access back.
• Opening an order is recorded, as on its order page, as a look from your own site. It is part of what a dispute can show the bank.
• productPath on an order’s line is the product’s path on your store’s own site.

​

Limits

​

When it says no

​

Keeping buyers safe

• Any site may ask the Customer API from a browser, and never with cookies. A page that was not handed a buyer’s token cannot do anything as them.
• The email tells the buyer to type the code only on the page where they asked for it. Ask for it there and nowhere else, never by chat or by email.
• A token is one buyer’s at one store. It reaches no route that takes an API key, and an API key reaches none of these.