API Reference

Authentication

Three modes by context: user session, store MCP token, or OAuth for Claude connectors.

1. User session Bearer

Routes such as /api/products and /api/orders expect Authorization: Bearer <access_token> from the Supabase Auth session after login.

Authorization: Bearer eyJhbGciOi…

Returns 401 if the token is missing or invalid.

2. Store MCP token

Mint a token in Settings → MCP (or POST /api/mcp/tokens). The secret is shown once and sent as Bearer to /api/mcp. store_id is taken from the token — never pass it in tool args.

Available scopes:

catalog:read
catalog:write
orders:read
orders:write
crm:read
analytics:read
inbox:read
storefront:read
storefront:write

3. OAuth (Claude.ai)

Paste the MCP URL only in Claude.ai, sign in to Sellio, pick a store, and Allow. Sellio mints a store-bound token. Token exchange: POST /api/oauth/token (application/x-www-form-urlencoded).

Store admin checks

Managing MCP tokens requires the store owner or an admin. Otherwise the API returns 403.

NextProducts