Authentication

Each API authenticates a different party:

API	Who is authenticated	Credential	Sent as
Admin API /api/v1	A marketplace administrator	API key + API secret	HTTP Basic
Partners API /api/partners/v1	One vendor	API key + API secret	HTTP Basic
Front API /front_api/v1	A signed-in member	Token obtained by logging in	Authorization: Bearer

Credentials are tied to one marketplace. Always call the marketplace’s primary address, see Base URLs. There are no scopes: a credential can do everything its owner can do through that API.

Admin API

Get your credentials

1. In the back office, open Settings → Account (/admin/settings/account).

2. In the API access section, click Generate secret key.

3. Copy the API key (pk_…) and the API secret (sk_…) into your secret store.

Credentials belong to the administrator account that generated them: each administrator of the marketplace has their own pair, shown only to them. Create a dedicated administrator for an integration if you want its credentials to be independent of a person.

Send them

Use HTTP Basic authentication with the key as the user name and the secret as the password, on every request:

GET /api/v1/orders HTTP/1.1
Host: acme.mykreezalid.com
Authorization: Basic cGtfN2YzYTljMjE6c2tfOWUxYjRkMDg=
Accept: application/json

curl

curl https://acme.mykreezalid.com/api/v1/orders -u "$KREEZALID_API_KEY:$KREEZALID_API_SECRET"

Node.js

const auth = Buffer.from(`${process.env.KREEZALID_API_KEY}:${process.env.KREEZALID_API_SECRET}`).toString('base64');
const res = await fetch('https://acme.mykreezalid.com/api/v1/orders', {
  headers: { Authorization: `Basic ${auth}` },
});

PHP

$ch = curl_init('https://acme.mykreezalid.com/api/v1/orders');
curl_setopt($ch, CURLOPT_USERPWD, getenv('KREEZALID_API_KEY') . ':' . getenv('KREEZALID_API_SECRET'));

Python

requests.get("https://acme.mykreezalid.com/api/v1/orders",
             auth=(os.environ["KREEZALID_API_KEY"], os.environ["KREEZALID_API_SECRET"]))

Send the header on the first request

The API does not answer with a 401 challenge: a request without credentials gets a 403 straight away. HTTP clients that wait for a challenge before sending credentials (some .NET and Java configurations do) never authenticate. Build the Authorization header yourself, as above.

Older integrations may use the administrator’s email address in place of the API key, with the same secret. It still works, but use the pk_ key for anything new.

Rotate or revoke

Click Generate a new key in Settings → Account → API access. A new key and secret are created and the previous pair stops working immediately, so update your integration right after. There is no separate “disable” button: generating a new pair is how you cut off credentials that leaked or that an old integration still holds.

Partners API

The Partners API authenticates a vendor, not an administrator. A credential belongs to one vendor account, and every call only sees that vendor’s listings, orders, stores and shipping rates.

There is no screen to generate Partners API credentials yet. They are issued on request: contact Kreezalid support with the marketplace and the vendor account concerned.

Send them exactly like Admin API credentials, with HTTP Basic:

curl https://acme.mykreezalid.com/api/partners/v1/orders -u "$PARTNER_API_KEY:$PARTNER_API_SECRET"

Front API

The Front API acts on behalf of a member of the marketplace, with their own email and password. There is no API key: the member logs in and receives a token.

Log in

curl -X POST https://acme.mykreezalid.com/front_api/v1/auth/login \
  -H "Content-Type: application/json" \
  -d '{"email": "jane@example.com", "password": "correct horse battery staple"}'

{
  "status": "success",
  "data": {
    "token": "eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJpc3MiOiJhY21lLm15a3JlZXphbGlkLmNvbSJ9.4k…"
  }
}

Status	Body message	Meaning
422	Invalid Email Address	No active account with this email.
422	Invalid Password	The password is wrong.
403	An error page, not JSON	The request already carries a valid session or token: log out first.

Call the API with the token

curl https://acme.mykreezalid.com/front_api/v1/auth/me \
  -H "Authorization: Bearer $TOKEN"

GET /front_api/v1/auth/me returns the signed-in member under me.

• The token is valid for one year from login and only on the marketplace that issued it. There is no refresh endpoint: when it expires, log in again.
• Every request re-checks the member: a token stops working as soon as the account is deactivated or blocked.
• DELETE /front_api/v1/auth/logout ends the server session, but it does not invalidate the token. To log a member out of your app, delete the token from the device.
• Store the token like a password: in the iOS Keychain, the Android Keystore, or an HttpOnly cookie of your own back end.

Inside a theme served on the marketplace’s own domain, the member’s storefront session is recognised too, so your theme’s JavaScript can call the Front API without handling a token.

Endpoints that need no token

Some endpoints serve visitors who are not signed in: POST /auth/login, POST /account/create, POST /account/forgot-password, POST /account/reset-password, POST /account/email-exist, the categories (GET /categories, GET /categories/{category_id}), GET /listings/attributes, a vendor’s public profile (GET /directories/{user_id}) and reviews (GET /reviews/user/{user_id}), and the guest cart (create a cart, view it, add, update and remove items). Everything else requires a member.

When authentication fails

API	Situation	Status	Body
Admin	No credentials sent	403	JSON, message: Access denied. Please use your API credentials to use the API
Admin	Wrong key or secret, or credentials of another marketplace	403	JSON, message: Permission denied, wrong credentials
Partners	No credentials, or wrong key or secret	403	An error page, not JSON
Front	No token	403	{"code": 403, "status": "error", "message": "Token not found in request"}
Front	Expired, malformed or foreign token	403	Same shape; message describes the problem, for instance Expired token

See Errors for the complete error format of each API.