Authentication

3.1 Login — POST /v1/account/api/auth/login

No captcha. No Bearer header.

Body

{
  "email": "you@example.com",
  "password": "YOUR_PASSWORD"
}

Success (200)

{
  "access_token": "",
  "refresh_token": "",
  "expires_in": 21600,
  "token_type": "bearer",
  "sms_verified": true,
  "need_sms_verification": false,
  "customer": {
    "id": 123,
    "email": "you@example.com",
    "first_name": "Ada",
    "last_name": "Lovelace"
  }
}

If two-factor auth is enabled, the response may instead be:

{
  "requires_tfa": true,
  "tfa_method": "google"
}

Then call Login TFA.

3.2 Login TFA — POST /v1/account/api/auth/login/tfa

{
  "email": "you@example.com",
  "password": "YOUR_PASSWORD",
  "tfa_code": "123456"
}

Returns the same token payload as login.

3.3 Refresh account token — POST /v1/account/api/auth/refresh

{
  "refresh_token": ""
}

Returns a new account access_token and refresh_token.

3.4 Logout — POST /v1/account/api/auth/logout

Requires account Bearer. Returns 204 No Content.

3.5 Me — GET /v1/account/api/auth/me

Requires account Bearer.
Returns the account profile including stores[] (id, handle, host, name, …).