API overview
Find the right API surface for your application.
Sellforge exposes HTTP endpoints grouped by domain. JSON endpoints accept Content-Type: application/json; authentication is typically sent using the Authorization header.
API surfaces
| Surface | Typical routes | Credentials |
|---|---|---|
| Merchant operations | /api/admin/products, /api/admin/orders | Admin session or scoped API token |
| Product writes | /api/products | Authorized session or supported write-scoped token |
| Public storefront | /api/store/products | Shop publishable key |
| Checkout creation | /api/store/checkout-sessions | Shop publishable key |
| Hosted checkout | /api/checkout/:id | Checkout session flow |
| Plugin management | /api/admin/plugins | Admin session; mutations require platform context |
Base URLs
Your deployment can serve these APIs on different hosts. Examples use these variables:
| Variable | Backend |
|---|---|
SELLFORGE_ADMIN_URL | Shop-admin API |
SELLFORGE_STORE_URL | Public shop API |
SELLFORGE_CHECKOUT_URL | Checkout API |
The standard local ports are 9201, 9203, and 9204 respectively. Confirm deployed URLs with your platform operator.
Authentication and permissions
API tokens are bound to their creator and tenant. A scope permits only the routes and methods explicitly allowed by the token policy. A valid token does not make every admin endpoint available.
Start with Authentication, then read API conventions.
Resources covered here
- Products: catalog queries and product writes.
- Orders: order lists, details, and status filtering.
- Storefront: shop identification and channel-aware product visibility.
- Checkout sessions: create a checkout and return the customer to your shop.
- Webhooks: signed checkout notifications.
Versioning
The current routes use /api/..., without a /v1 path prefix. The source-review date on each guide identifies the implementation used for the reference. Check changes against your deployed kernel before depending on new fields or endpoints.
Found something unclear? Let us know