Who is signed in, and every store they can act on
- Credentials
- OAuth access token
- Scopes
store:read
A person with no ShopEazy profile yet gets stores: [] and defaultStoreId: null (they go to onboarding).
Access: OAuth scope store:read; not write-gated.
merchantOAuth store:readAuthorizationBearer <token>OAuth 2.1 (authorization code + PKCE S256, public clients, dynamic registration) for connected AI apps. Effective power is scopes granted AND the person's role today AND the plan. orders:refund, billing:write and team:write are opt-in on the consent screen. Write implies read for marketing:read and messages:read, so a grant holding marketing:write passes a marketing:read check, and messages:send passes messages:read.
Scope: store:read
OK
application/json- response
data*curl -X GET 'https://api.shopeazy.co/v1/merchant/session' \ -H 'Authorization: Bearer <access_token>'{ "data": { "user": { "id": "npqAR4xoxDVcFhxPnTvXJiOAMwNO", "email": "jabu.nkosi@example.com", "displayName": "Jabu Nkosi", "photoURL": null }, "stores": [ { "id": "w82oaN7OkGK7BykWs2Ag", "workspaceId": "EjblZNtyBUWK7jGqf7ST", "name": "Jabu's Plant Shop", "slug": "jabus-plant-shop", "logoUrl": null, "currency": "ZAR", "role": "owner", "kitTypes": [ "physical", "service", "ticketing" ] } ], "defaultStoreId": "w82oaN7OkGK7BykWs2Ag", "grant": { "id": "6Iu0fUYMTBNiWTTfVBmF", "clientName": "Example app", "scopes": [ "store:read", "listings:read", "listings:write" ], "storeIds": null } }}Merchant API
Every Merchant API operation, with its scopes, parameters, responses and request samples.
The businesses the person belongs to, with their stores GET
Each business with the person's role in it, its plan, how many stores it has and may have, and its stores (the same summaries as `getSession`). A client picks the store to work on from here and puts its id in the path of every call: switching is client state, so there is nothing to call for it. A connected AI app sees only the business, and the stores, it was granted; `storeCount` is still the business's real count, which is what the plan's cap counts. A person with no business yet gets an empty list. Access: OAuth scope `store:read`; not write-gated. Paged: `{ items, nextCursor }`, `limit` (default 50, at most 100) and an opaque `cursor`.