Exchange a Firebase ID token for a 14-day shopper session
- Credentials
- Store key
- Scopes
members:write
Verified against the store's own sign-in tenant (store.auth.tenantId); a token from another pool is refused. The shopper's profile is mirrored into the store. Keep sessionToken in your own httpOnly cookie and send it as X-Shopper-Session.
Old path, deprecated, sunset 1 Feb 2027: POST /v1/shopper/session.
storeKey members:writeAuthorizationBearer <sez_pub_... (publishable) or sez_sk_... (secret)>A per-store key from the console. Publishable keys are browser-safe; secret keys are server-only.
Scope: members:write
application/json- body
idToken*stringA fresh Firebase ID token for the shopper.
The session.
application/json- response
data*curl -X POST 'https://api.shopeazy.co/v1/store/shopper/session' \ -H 'Authorization: Bearer sez_pub_...' \ -H 'Content-Type: application/json' \ -d '{ "idToken": "eyJhbGciOiJSUzI1NiJ9.EXAMPLE.SIGNATURE"}'{ "data": { "sessionToken": "shs_EXAMPLE", "expiresAt": 1794134000907, "shopper": { "uid": "N5QACKmZ7d37y4LqAkQzUrk1Fci0", "email": "thandi.mokoena@example.com", "name": "Thandi Mokoena", "phone": null } }}File a contact-form enquiry and tell the merchant POST
Recorded in the store **before** anything is sent; the merchant notification and email are best-effort and never fail the call, so do not retry a `201`. The recipient, subject and body are composed server-side from structured fields; there is deliberately no "send an email" endpoint. A `name` and at least one of `phone` or `email` are required. Strings are trimmed and capped (name 120, phone 40, email 200, service 120, notes 2000 characters). Old path, deprecated, sunset 1 Feb 2027: `POST /v1/booking-requests`.
Sign the shopper out DELETE
Revokes the shopper's refresh tokens. Best-effort; a missing or already-invalid session is not an error. Clear your cookie either way. Old path, deprecated, sunset 1 Feb 2027: `DELETE /v1/shopper/session`.