Skip to main content
POST
Authenticate
V2 Preview — This endpoint is part of the V2 API preview. Breaking changes may occur.

Overview

Exchange your vendor API key for a short-lived JWT token. The token is scoped to your vendor account and carries the permissions granted to your API key. Tokens expire after 24 hours. When a token expires, either re-authenticate or use POST /refresh-token to get a new one.

Use Cases

  • Vendor portal apps — Secure, isolated access to your vendor data
  • Custom integrations — Sync your orders, products, and payouts with external systems
  • AI agents — Programmatic access with scoped permissions

Request Body

string
required
Your vendor API key (starts with vk_). Create one in the vendor portal under Settings > API Keys, or ask your merchant.
string
Optional. The shop is resolved from your API key. Only send this if your key works across multiple shops — if it doesn’t match, the request is rejected.

Response

200

Response Fields

Error Responses

401
401
401
401
429

Examples