Skip to main content
Print

HTTP API for merchants and integration partners to manage a Zencommerce store the same way as the accounts and admin web apps: sign in → select a store → run catalog, orders, customers, content, and settings operations.

Audience: external developers and technical partners

API prefix: /v1/account/api

Getting started

Base URL

API_BASE="https://core-api.myzencommerce.in"

Auth flow (same as the web apps)

  1. Account login → account access_token + refresh_token
  2. List shops or create a shop (account Bearer)
  3. Shop access-token for a shop id → shop access_token + refresh_token
  4. Call all store operations with the shop Bearer token

Authorization: Bearer {token}

Token Used for
Account access_token /auth/me, /auth/logout, /shops
(list/create/check-availability),
/shops/{id}/access-token
Shop access_token Products, orders, customers, settings, … (everything under shop scope)

Account tokens expire in 6 hours; account refresh tokens in 24 hours.

Shop tokens expire in 6 hours; shop refresh tokens in 24 hours.

Request formats

Format Usage
application/json Most operations
multipart/form-data Uploads (/uploads, product/collection images)

Quick start

1) Login (no Bearer required)

curl -sS -X POST "$API_BASE/v1/account/api/auth/login" \

  -H "Content-Type: application/json" \

  -d '{"email":"you@example.com","password":"YOUR_PASSWORD"}'

Note: Save access_token and refresh_token from the response

ACCOUNT_TOKEN="..."

ACCOUNT_REFRESH="..."

2) List shops (or create one with POST /v1/account/api/shops)

curl -sS "$API_BASE/v1/account/api/shops" \

  -H "Authorization: Bearer $ACCOUNT_TOKEN"

3) Select a shop (replace SHOP_ID)

curl -sS -X POST "$API_BASE/v1/account/api/shops/SHOP_ID/access-token" \

  -H "Authorization: Bearer $ACCOUNT_TOKEN"

SHOP_TOKEN="..."          # shop access_token

SHOP_REFRESH="..."        # shop refresh_token

4) Call shop-scoped APIs

curl -sS "$API_BASE/v1/account/api/products" \

  -H "Authorization: Bearer $SHOP_TOKEN"
Errors
Error bodies commonly look like:

{

  "message": "Human-readable message",

  "code": 400,

  "errors": null

}
HTTP Typical meaning
401 Missing/invalid/expired token
403 Forbidden (e.g. missing refresh token)
404 Resource not found or wrong credentials on login
400 Validation / business rule failure
Scroll to Top