Help CenterHelp Center / Developers · Reference
How a program signs in to the Shop API, how to check a token, and the request limit.
The Shop API accepts a token that belongs to one panel account. A call made with it acts as that person.
Base address: your panel address followed by /api/shop. Send JSON, and send Accept: application/json so errors come back as JSON.
There are two ways.
From the panel. The owner opens Shop › Whatsapp Api & Webhooks and selects 1. Generate token, or Regenerate when one exists. 2. Show token reveals it and 3. Copy copies it. The steps are on Whatsapp Api & Webhooks.
By signing in. POST /api/shop/login
| Field | Required | Meaning |
|---|---|---|
email | Yes | E-mail of a shop owner or shop staff account |
password | Yes | That account's password |
{ "success": true, "data": { "auth_token": "<your token>", "user_id": 42 }, "message": [] }
Wrong details fail validation with "username or password incorrect" on the password field.
Send it as a header on every call:
curl -X POST 'https://<your panel address>/api/shop/product/bulk-update' \
-H 'Authorization: Bearer <your token>' \
-H 'Content-Type: application/json' -H 'Accept: application/json' \
-d '{"products":[{"id":1042,"price":120}]}'
The panel states that the token does not expire.
POST /api/shop/validate-login
| Field | Required | Meaning |
|---|---|---|
auth_token | Yes | The token you hold |
user_id | Yes | The user_id returned with it |
It answers with the same auth_token and user_id when the pair is the one stored for an owner or a Shop Manager. Otherwise validation fails with "invalid auth_token or user_id". A token that was replaced by a newer one fails this check.
| Rule | Value |
|---|---|
| Requests | 500 a minute. Beyond that the answer is HTTP 429 |
| Missing or refused token on a protected call | HTTP 403 with the text "Unauthorized." |
Under /api/shop there is one data call: bulk update products. To create products, sync stock or read orders, use the incoming API, which has its own token.