​
Welcome

There are two ways to build API documentation: OpenAPI and MDX components. For the starter kit, we are using the following OpenAPI specification.

​
Authentication flow

1

Obtaining the Anonymous Access Token

  1. Call the /anonymous auth endpoint.
  2. Provide the X-Api-Key in the header with the API key specific to your store (available in the Commerce Engine store settings).
  3. This endpoint returns an access token and a refresh token.
2

Using the access token

  1. The obtained access token is used to authenticate all other API requests.
  2. The token has limited privileges based on the user’s logged-in state.
3

User Identification - Token Exchange

  1. For user-specific data access (like order history), a more privileged token is needed.
  2. This is obtained after a user logs in or registers.
  3. The User object returned from authentication endpoints contains is_anonymous and is_logged_in booleans.
4

Token Refresh

When the access token is near expiration, request a token refresh using the refresh token. The server validates this request and issues a new access token.

Anonymous user