Every POS. Every ERP. One sync layer.

Two steps. First, exchange your API key for a short-lived JWT — never send your raw API key on every request, only to get a token. Second, send that token as a Bearer header on every call after.

Send your API key in the X-Api-Key header (not the body).

Copycurl -X POST https://yourdomain.com/api/dev/token \
  -H "X-Api-Key: pk_live_xxxxxxxxxxxxxxxxxxxxxxxxxx"

Copy{
  "success": true,
  "data": {
    "accessToken": "eyJhbGciOi...",
    "expiresOnUtc": "2026-07-23T10:15:00Z",
    "tokenType": "Bearer"
  }
}

Use it on every following call: Authorization: Bearer eyJhbGciOi.... Request a new token once it expires — there's no refresh token for developer keys, just call this again.

Every response — success or failure — is shaped the same way:

Copy{ "success": false, "message": "This key doesn't have the 'items:write' scope.", "data": null }

Paginated, max 25 per page regardless of what you request.

Copy{
  "success": true,
  "data": {
    "items": [
      { "itemId": "b1f2...", "itemName": "Chicken Biryani", "mrp": 250, "sellingPrice": 220, "quantity": 50, "hasVariants": false }
    ],
    "totalCount": 42
  }
}

Create or update a product. Include itemId to update; omit (or send an empty GUID) to create.

Returns every category for your store (not paginated — stores typically have a handful).

Creates an order directly — the storefront's usual email-verification step is skipped since the API key call is already authenticated.

Active discounts/promo codes configured for your store.

Same data as Products (quantity is one of the returned fields), paginated identically.