Authentication (REST)

The full authentication model — public access, customer login, guest checkout, and admin — lives on the central Authentication page. This page is the REST-specific quickref: the base URLs, the headers, and the exact calls.

Base URLs

Surface	Base	Headers
Shop	/api/shop/*	X-STOREFRONT-KEY (always) + Authorization: Bearer <token> for customer actions
Admin	/api/admin/*	Authorization: Bearer <id>|<token> only (no storefront key)

Public access

The X-STOREFRONT-KEY alone gives read-only access to public data (products, categories, CMS):

curl -X GET "https://your-domain.com/api/shop/products" \
  -H "X-STOREFRONT-KEY: pk_storefront_xxxxxxxxxxxxx"

Customer login — get a token

curl -X POST "https://your-domain.com/api/shop/customer/login" \
  -H "Content-Type: application/json" \
  -H "X-STOREFRONT-KEY: pk_storefront_xxxxxxxxxxxxx" \
  -d '{"email":"[email protected]","password":"SecurePass@123"}'

The response returns token (format <id>|<secret>) — send it as Authorization: Bearer <token> on every authenticated request. Use token, not apiToken (a legacy field that is not a Bearer). There is no refresh token — on a 401, log in again. Full field reference on the Customer Login page.

Guest — act without login

A guest can build a cart and place an order using a cart token as the Bearer: create a cart to obtain the token — Create Cart — then send it as Authorization: Bearer <cartToken> alongside the X-STOREFRONT-KEY on cart and checkout calls. See the Cart and Checkout workflows.

Admin

Admin clients use a pre-issued Integration token (no login) sent as Authorization: Bearer <id>|<token> to /api/admin/*. See Admin Authentication for the token model, permissions, IP allowlist, expiry, and rate limits.

Related

• Authentication — the full model (public / customer / guest / admin)
• Status Codes — how failures are reported (including 401)
• Pagination · Sorting