SmartDepot Developers

Connect commerce with SmartDepot

Build secure cart, order and shipment integrations. Start immediately in the isolated sandbox and request production access when ready.

Developer Console OpenAPI 3.1 Deutsch

curl https://sandbox-api.smartdepot.org/api/v1/orders \
  -H "Authorization: Bearer $TOKEN" \
  -H "Idempotency-Key: order-4711" \
  -H "Content-Type: application/json" \
  --data @order.json

1. Sandbox

2. OAuth + PKCE

Customers select a workspace and explicit write scopes.

3. Production

Submit domains and use case for review.

Quickstart

OAuth Authorization Code

Generate a PKCE verifier and S256 challenge.
Open /oauth/authorize with requested scopes.
Exchange the one-time code at /oauth/token.
Send the bearer token to Orders or Shipments.

Security contract

Access tokens expire after 15 minutes; refresh tokens rotate.
Idempotency-Key is mandatory on write endpoints.
Cart handoffs use timestamped HMAC-SHA256 requests.
No inventory, workspace or user read API is exposed.

// JavaScript (server-side)
await fetch(`${api}/api/v1/orders`, {
  method: "POST",
  headers: {
    Authorization: `Bearer ${token}`,
    "Idempotency-Key": order.id,
    "Content-Type": "application/json"
  },
  body: JSON.stringify(order)
});

<?php
$client = new GuzzleHttp\Client();
$client->post($api . '/api/v1/shipments', [
  'headers' => [
    'Authorization' => 'Bearer ' . $token,
    'Idempotency-Key' => $shipment['external_shipment_id']
  ],
  'json' => $shipment
]);

Endpoints & errors

Method	Path	Authentication
POST	`/api/v1/cart-handoffs`	HMAC
POST	`/api/v1/orders`	`orders:write`
POST	`/api/v1/shipments`	`shipments:write`

Errors use stable codes including invalid_token, insufficient_scope, invalid_payload, order_not_found and idempotency_conflict. Rate-limited requests return HTTP 429.

Changelog

v1.0.0 — Cart handoff, OAuth/PKCE, Orders and Shipments API.

PHP and JavaScript clients use the same standard HTTP and OAuth flows shown in the OpenAPI description. Secrets must remain server-side and can be rotated from the console.