Create a limited token
Creates a limited token for a shopper's browser. A limited token works like a session: it can read your public catalog, and it can change only the carts, payments and other objects it created itself.
Call it without an Authorization header from the browser, with your account_id in the query string (400 without it). The new token is live. To get a test token this way, add test=true. That works only when your account allows limited test tokens without a token (Settings, Technical, allow_public_limited_test_tokens); otherwise the answer is 403.
Your server may also call it with a secret or trusted token that may create tokens. Then account_id is optional (it must match the token, 400 otherwise), the new token takes the mode of your token unless you send test, and you may send a customer_id to make the token for one customer. A limited token in the header is refused (403): to get a new one, call without a header.
A new limited token lasts two hours. Each use moves the expiry forward, and a token that keeps being used lasts longer: 12 hours for its first uses, 24 hours after 5 uses and 15 days after 10 uses.
bearerAuthorizationBearer <token>A secret, trusted or limited token. See Authentication.
account_id?stringYour account ID. Required when you call without a token. With a token, it must match the token's account.
test?booleantrue for a test token, false for a live one. Without a token the default is live. With a token the default is your token's mode.
browser_info?booleanWhen true, the response also has browser_info.
falseuser_ip_address?stringThe shopper's IP address, when your server calls with a secret token on the shopper's behalf. Comecero uses it for fraud checks and to find the shopper's country. Only read for a secret token: for every other token the address the request comes from is used. A value that is not a valid IPv4 or IPv6 address is ignored.
application/json- body
Optional. Send it only to make a token for one customer.
customer_id?stringMake the token for this customer, so it can read and update that customer. Needs a secret or trusted token that may create tokens and update customers (403 otherwise).
The new limited token, with the full token value.
application/json- response
An API token. The full token is shown only once, in the response that creates it. After that token holds a masked copy. A token's auth_id is the SHA-256 hash of the full token, so you can look a token up without sending it.
Test or live mode comes from the token. A token whose test is true reads and writes only test data, and a live token only live data. There is no test header. The test query parameter only counts when you create a token (such as POST /auths/secret or POST /auths/limited), where it picks the mode of the new token.
object?"auth"The object type. Always auth.
"auth"url?stringThe URL of this token.
uriauth_id?stringThe SHA-256 hash of the full token, in lower-case hex.
test?booleanTrue for a test token. A test token reads and writes only test data.
account_id?stringThe account the token belongs to.
account_alias?|The alias of the account the token belongs to.
type?stringThe token type. secret is for your server. trusted belongs to a signed-in dashboard user and is used in the browser. limited is used in the browser by shoppers. admin, app and service are used by Comecero itself and are not issued to integrators.
"secret""trusted""limited""admin""app""service"ip_address?|The IP address the token was issued to. Set for trusted and limited tokens, null for secret tokens.
token?stringThe full token in the response that creates it. Every other response gives a masked copy, such as secret.live.Kd4...9f2a. The full token starts with its type and its mode, for example secret.live. or limited.test..
expires?|When the token stops working. Null when it never expires. Trusted and limited tokens move this date forward each time they are used.
date-timeexpires_in_seconds?|Seconds until expires. Null when the token never expires.
date_last_used?|The day a secret token was last used, updated at most once a day. Null for other token types and for a token never used.
date-timecomments?|Your own label for the token, up to 250 characters.
length <= 250date_created?stringWhen the token was created.
date-timedate_modified?stringWhen the token was last changed.
date-timecustomer?|The customer a limited token was made for, as a URL, or the customer object when you send expand=customer. Only present on a token made for a customer.
user?|The user a trusted token belongs to, as a URL, or the user object when you send expand=user. Only present on a token tied to a user.
roles?array<string>The role_id of each role given to the token.
permissions?array<>The permissions given to the token directly.
effective_permissions?What the token or user may really do, after its roles and permissions are combined and cut down to what its token type allows. Each key is a resource and each value says which methods are allowed on it.
browser_info?Details about the caller's browser, read from the request headers. Only in the response that creates a token, and only when you send browser_info=true.
formatted?Display text for the dates. Only present when you send formatted=true.
curl -X POST 'https://api.comecero.com/api/v1/auths/limited?account_id=AB1234' \ -H 'Content-Type: application/json' \ -d '{ "customer_id": "0106784119870CueWmZ9P7"}'{ "object": "auth", "url": "https://api.comecero.com/api/v1/auths/fcde2b2edba56bf408601fb721fe9b5c338d10ee429ea04fae5511b68fbf8fb9", "auth_id": "fcde2b2edba56bf408601fb721fe9b5c338d10ee429ea04fae5511b68fbf8fb9", "test": true, "account_id": "AB1234", "account_alias": "example-shop", "type": "limited", "ip_address": "203.0.113.10", "token": "limited.test.Pq3Wn7Rx1Ks5Lm9Vb2Zc8Fd4Gh6Jt0Ya3Ue7Io1Mk5Nq.1793887012.1a2b3c4d5e", "expires": "2026-11-07T16:36:52Z", "expires_in_seconds": 7200, "date_last_used": null, "comments": null, "date_created": "2026-11-07T14:36:52Z", "date_modified": "2026-11-07T14:36:52Z", "roles": [], "permissions": [ { "resource": "*", "methods": [ "*" ], "allow": true } ], "effective_permissions": { "carts": { "create": true, "read": true, "update": true, "delete": true }, "products": { "create": false, "read": true, "update": false, "delete": false } }}List tokens GET
Lists the tokens of your account in the mode of the token you call with: a test token lists test tokens, a live token lists live tokens. The list is offset-based. Each token shows a masked `token`, never the full value. To find one token, send the full token in `q`. You get that token, or an empty list. Secret and trusted tokens may call this with the `auths` read permission.
List token permission options GET
Lists the resources and methods a token of one type may be given. Use it to build a permissions form, or to check a request before you create a secret token. Send `type`: without it the list is empty. Any valid token may call this, including a limited token. No permission is needed.