List token permission options
Lists the resources and methods a token of one type may be given. Use it to build a permissions form, or to check a request before you create a secret token. Send type: without it the list is empty.
Any valid token may call this, including a limited token. No permission is needed.
AuthorizationBearer <token>A secret, trusted or limited token. See Authentication.
type?stringThe token type to list the options for.
"secret""trusted""limited"show?stringComma-separated fields to return; all others are left out. Use dot notation for child fields (customer.email). You cannot send show and hide together (400). See Customizing output.
hide?stringComma-separated fields to leave out of the response. Use dot notation for child fields (customer.email). You cannot send show and hide together (400). See Customizing output.
The permissions the token type may be given.
application/json- response
The permissions a token of one type may be given.
account_id?stringThe account of the token you called with.
test?booleanTrue when you called with a test token.
permissions?array<>Each resource the token type may be given, with the methods it may have on it. Empty when you leave out type.
curl -X GET 'https://api.comecero.com/api/v1/auths/options'{ "account_id": "AB1234", "test": true, "permissions": [ { "resource": "carts", "methods": [ "create", "read", "update", "delete" ] }, { "resource": "products", "methods": [ "read" ] } ]}Create a limited token POST
Creates a limited token for a shopper's browser. A limited token works like a session: it can read your public catalog, and it can change only the carts, payments and other objects it created itself. Call it without an `Authorization` header from the browser, with your `account_id` in the query string (`400` without it). The new token is live. To get a test token this way, add `test=true`. That works only when your account allows limited test tokens without a token (Settings, Technical, `allow_public_limited_test_tokens`); otherwise the answer is `403`. Your server may also call it with a secret or trusted token that may create tokens. Then `account_id` is optional (it must match the token, `400` otherwise), the new token takes the mode of your token unless you send `test`, and you may send a `customer_id` to make the token for one customer. A limited token in the header is refused (`403`): to get a new one, call without a header. A new limited token lasts two hours. Each use moves the expiry forward, and a token that keeps being used lasts longer: 12 hours for its first uses, 24 hours after 5 uses and 15 days after 10 uses.
Create a secret token POST
Creates a secret token for your server. The response is the only time you see the full token, so store it safely. Keep secret tokens on your server and never put one in a browser or an app. The new token is live unless you send `test=true` in the query string. The mode of the token you call with does not decide it: a test token that leaves out `test=true` asks for a live token and gets `403`. Give the token only the permissions it needs. It needs at least one role or one permission, and the token you call with must hold every permission you ask for. Secret and trusted tokens may call this with the `auths` create permission.