curl --request POST \
--url https://production-api.puppetvendors.com/authenticate \
--header 'Content-Type: application/json' \
--header 'x-access-token: <api-key>' \
--data '
{
"apiKey": "mk_live_9f2ac1b0e7d84a3c5b1f6e8d0a2c4b6f8e0d2c4b6a8f0e2d4c6b8a0f2e4d6c8b"
}
'{
"success": true,
"data": {
"token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...",
"expiresIn": 1209600,
"scope": "merchant",
"shopDomain": "my-store.myshopify.com"
}
}{
"success": false,
"error": {
"message": "Invalid API key",
"code": "UNAUTHORIZED"
}
}Authentication
Authenticate and get API token
Authenticate using an API key to obtain a JWT token. The key’s prefix determines the token scope:
- Merchant key (
mk_live_…/mk_test_…, from Settings → API Access): returns a merchant-scoped token with full access. Named, rotatable and revocable per integration. - Vendor key (
vk_live_…/vk_test_…, from the vendor portal): returns a vendor-scoped token limited to that vendor’s data, carrying the scopes declared on the key.
A rotated key keeps working until the end of its grace window, so a rotation is an overlap rather than a cutover.
POST
/
authenticate
curl --request POST \
--url https://production-api.puppetvendors.com/authenticate \
--header 'Content-Type: application/json' \
--header 'x-access-token: <api-key>' \
--data '
{
"apiKey": "mk_live_9f2ac1b0e7d84a3c5b1f6e8d0a2c4b6f8e0d2c4b6a8f0e2d4c6b8a0f2e4d6c8b"
}
'{
"success": true,
"data": {
"token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...",
"expiresIn": 1209600,
"scope": "merchant",
"shopDomain": "my-store.myshopify.com"
}
}{
"success": false,
"error": {
"message": "Invalid API key",
"code": "UNAUTHORIZED"
}
}Authorizations
Body
application/json
Shop's openApiToken for authentication
Example:
"sk_live_abc123def456"
Optional shop domain (V1 compatibility). When provided, must match the shop for the apiKey.
Example:
"my-store.myshopify.com"
Optional vendor ObjectId for vendor-scoped token
Example:
"507f1f77bcf86cd799439011"
Was this page helpful?