Create a test trusted token
Swaps a live trusted token for a test trusted token with the same user and permissions. Use it when a signed-in user switches the dashboard or your own tool to test mode.
You cannot ask for any other kind of trusted token. Trusted tokens are given to users when they sign in, not created through the API. Send test=true in the query string (400 without it) and no request body (403 with one). The token you call with must be a live trusted token (403 otherwise).
The new token lasts two hours from its last use.
AuthorizationBearer <token>A secret, trusted or limited token. See Authentication.
test*trueMust be true.
truebrowser_info?booleanWhen true, the response also has browser_info.
falseThe new test trusted token, with the full token value.
application/json- response
An API token. The full token is shown only once, in the response that creates it. After that token holds a masked copy. A token's auth_id is the SHA-256 hash of the full token, so you can look a token up without sending it.
Test or live mode comes from the token. A token whose test is true reads and writes only test data, and a live token only live data. There is no test header. The test query parameter only counts when you create a token (such as POST /auths/secret or POST /auths/limited), where it picks the mode of the new token.
object?"auth"The object type. Always auth.
"auth"url?stringThe URL of this token.
uriauth_id?stringThe SHA-256 hash of the full token, in lower-case hex.
test?booleanTrue for a test token. A test token reads and writes only test data.
account_id?stringThe account the token belongs to.
account_alias?|The alias of the account the token belongs to.
type?stringThe token type. secret is for your server. trusted belongs to a signed-in dashboard user and is used in the browser. limited is used in the browser by shoppers. admin, app and service are used by Comecero itself and are not issued to integrators.
"secret""trusted""limited""admin""app""service"ip_address?|The IP address the token was issued to. Set for trusted and limited tokens, null for secret tokens.
token?stringThe full token in the response that creates it. Every other response gives a masked copy, such as secret.live.Kd4...9f2a. The full token starts with its type and its mode, for example secret.live. or limited.test..
expires?|When the token stops working. Null when it never expires. Trusted and limited tokens move this date forward each time they are used.
date-timeexpires_in_seconds?|Seconds until expires. Null when the token never expires.
date_last_used?|The day a secret token was last used, updated at most once a day. Null for other token types and for a token never used.
date-timecomments?|Your own label for the token, up to 250 characters.
length <= 250date_created?stringWhen the token was created.
date-timedate_modified?stringWhen the token was last changed.
date-timecustomer?|The customer a limited token was made for, as a URL, or the customer object when you send expand=customer. Only present on a token made for a customer.
user?|The user a trusted token belongs to, as a URL, or the user object when you send expand=user. Only present on a token tied to a user.
roles?array<string>The role_id of each role given to the token.
permissions?array<>The permissions given to the token directly.
effective_permissions?What the token or user may really do, after its roles and permissions are combined and cut down to what its token type allows. Each key is a resource and each value says which methods are allowed on it.
browser_info?Details about the caller's browser, read from the request headers. Only in the response that creates a token, and only when you send browser_info=true.
formatted?Display text for the dates. Only present when you send formatted=true.
curl -X POST 'https://api.comecero.com/api/v1/auths/trusted?test=true'{ "object": "auth", "url": "https://api.comecero.com/api/v1/auths/2c26b46b68ffc68ff99b453c1d30413413422d706483bfa0f98a5e886266e7ae", "auth_id": "2c26b46b68ffc68ff99b453c1d30413413422d706483bfa0f98a5e886266e7ae", "test": true, "account_id": "AB1234", "account_alias": "example-shop", "type": "trusted", "ip_address": "203.0.113.10", "token": "trusted.test.Ty5Qm8Rk2Lp9Wv3Xz7Bn4Cd1Fg6Hj0Sa8Ue2Io5Kl3Mq.1793887012.8c2f5a7b1d", "expires": "2026-11-07T16:36:52Z", "expires_in_seconds": 7200, "date_last_used": null, "comments": null, "date_created": "2026-11-07T14:36:52Z", "date_modified": "2026-11-07T14:36:52Z", "user": "https://api.comecero.com/api/v1/users/john.doe", "roles": [], "permissions": [ { "resource": "*", "methods": [ "*" ], "allow": true } ], "effective_permissions": { "orders": { "create": true, "read": true, "update": true, "delete": true } }}Create a secret token POST
Creates a secret token for your server. The response is the only time you see the full token, so store it safely. Keep secret tokens on your server and never put one in a browser or an app. The new token is live unless you send `test=true` in the query string. The mode of the token you call with does not decide it: a test token that leaves out `test=true` asks for a live token and gets `403`. Give the token only the permissions it needs. It needs at least one role or one permission, and the token you call with must hold every permission you ask for. Secret and trusted tokens may call this with the `auths` create permission.
Get a token GET
Gets one token by its `auth_id`. Use `me` to see the token you are calling with, for example to read its permissions or its expiry. Any token may read itself with `me`, including a limited token. To read another token you need a secret or trusted token with the `auths` read permission. A test token cannot read a live token (`404`).