Developer API

Authentication

• Seller dashboard sessions via Supabase Auth (cookie-based).
• Storefront customer sessions via store-scoped tokens.
• Store API keys: Authorization: Bearer ap_<keyId>_<secret> on /api/v1/open with scoped permissions and rate limits.

Store API

GET /api/v1/open?resource=... — public store API resources:

• store — store profile
• products — list or fetch by slug
• categories
• inventory — requires variantId
• customers
• orders — list or fetch by orderId
• payments — requires orderId
• fulfillment — requires orderId

Other surfaces

• /api/v1/stores/:id/integrations — API keys, webhooks, Telegram, suppliers
• /api/v1/finance — balance, deposits, gateway, escrow
• /api/v1/webhooks/payments/:provider — inbound payment webhooks
• /api/v1/webhooks/telegram/:storeId — Telegram Bot updates

Outbound webhooks

Signed with X-RentedMall-Webhook-Signature: t=<ts>,v1=<hmac>. Verify timestamp tolerance to reject replays. Events include order.paid, payment.succeeded, fulfillment.completed, and more.

Conventions

• problem+json errors with request IDs
• Server-side tenant authorization on every sensitive route
• Idempotency keys for checkout and financial side effects
• Cross-tenant denials return identical not-found responses
• Money as integer minor units only — never floating point
• Rate limits enforced for public API keys

API guide · Webhooks guide · Product page