Authentication
Credentials for the Store and Admin APIs.
Waylo Commerce uses Medusa's auth. You get tokens and sessions from Medusa's auth routes, then send them to the Waylo Commerce routes. Each endpoint page lists the schemes it accepts.
Store API
Every store route needs a publishable API key, plus a customer credential on routes that act for a customer.
| Scheme | How to send it |
|---|---|
| Publishable API key | x-publishable-api-key: pk_... header. Create one in the admin under Settings > Publishable API Keys. It ties requests to a sales channel. |
| Customer token | Authorization: Bearer <jwt>, from POST /auth/customer/{provider}. |
| Customer session | The connect.sid cookie, after exchanging a token at POST /auth/session. |
curl http://localhost:9000/store/companies/me \
-H "x-publishable-api-key: pk_..." \
-H "Authorization: Bearer <customer token>"Registration tokens
Company signup (POST /store/companies) also accepts a registration token from POST /auth/customer/{provider}/register, before a customer exists. Send customer in the body and a customer is created with the company. Then refresh the token with POST /auth/token/refresh so it carries the new customer. Other routes don't accept registration tokens.
Admin API
| Scheme | How to send it |
|---|---|
| Admin token | Authorization: Bearer <jwt>, from POST /auth/user/{provider}. |
| Admin session | The connect.sid cookie. This is what the admin dashboard uses. |
| Secret API key | HTTP Basic, with the secret key as the username and an empty password. For servers and integrations. |
curl http://localhost:9000/admin/companies \
-u "sk_...:"Secret API keys have full admin access. Keep them on the server. Never ship one to a browser or mobile app.