curl --request POST \
  --url https://production-api.puppetvendors.com/verify \
  --header 'Content-Type: application/json' \
  --header 'x-access-token: <api-key>' \
  --data '
{
  "apiKey": "mk_live_9f2ac1b0e7d84a3c5b1f6e8d0a2c4b6f8e0d2c4b6a8f0e2d4c6b8a0f2e4d6c8b"
}
'

{
  "success": true,
  "data": {
    "valid": true,
    "scope": "vendor",
    "permissions": [
      "orders:read",
      "products:read"
    ],
    "mode": "live",
    "keyLabel": "Zapier",
    "shopDomain": "my-store.myshopify.com",
    "vendorId": "507f1f77bcf86cd799439011",
    "vendorEmail": "vendor@example.com"
  }
}

{
  "success": false,
  "error": {
    "message": "Invalid API key",
    "code": "UNAUTHORIZED"
  }
}

Authentication

Verify an API key reaches the service

Pure probe — confirms the key is valid and reachable, returns the scopes/mode/identity it carries, but does NOT issue a JWT or count as a use (lastUsedAt unchanged).

Same lookup as /authenticate, so any key that passes here will also pass /authenticate. Useful when an integration wants a side-effect-free “is my key good?” check without minting a token.

Accepts the same keys /authenticate does: a merchant mk_ key or a vendor vk_ key. For a merchant key the reply carries scope: merchant and the key’s label, and no vendorId.

A revoked key is refused with the same 401 and the same message as a key that never existed, so this cannot be used to probe which keys once existed. A key inside its rotation grace window is still valid here.

POST

verify

curl --request POST \
  --url https://production-api.puppetvendors.com/verify \
  --header 'Content-Type: application/json' \
  --header 'x-access-token: <api-key>' \
  --data '
{
  "apiKey": "mk_live_9f2ac1b0e7d84a3c5b1f6e8d0a2c4b6f8e0d2c4b6a8f0e2d4c6b8a0f2e4d6c8b"
}
'

{
  "success": true,
  "data": {
    "valid": true,
    "scope": "vendor",
    "permissions": [
      "orders:read",
      "products:read"
    ],
    "mode": "live",
    "keyLabel": "Zapier",
    "shopDomain": "my-store.myshopify.com",
    "vendorId": "507f1f77bcf86cd799439011",
    "vendorEmail": "vendor@example.com"
  }
}

{
  "success": false,
  "error": {
    "message": "Invalid API key",
    "code": "UNAUTHORIZED"
  }
}

Authorizations

x-access-token

string

header

required

Body

application/json

apiKey

string

required

Shop's openApiToken for authentication

Example:

"sk_live_abc123def456"

shopDomain

string

Optional shop domain (V1 compatibility). When provided, must match the shop for the apiKey.

Example:

"my-store.myshopify.com"

vendorId

string

Optional vendor ObjectId for vendor-scoped token

Example:

"507f1f77bcf86cd799439011"

Response

Key is valid

success

boolean

data

object

Show child attributes

Getting Started

Authentication

Vendors

Users

Payouts

Verify an API key reaches the service

Authorizations

Body

Response