Authentication

Authentication methods

JWT Bearer token

Used for user sessions (web/mobile apps).

# Login to get token
POST /api/v1/auth/login
{ "email": "user@example.com", "password": "password" }

# Response
{
  "access_token": "eyJ...",
  "refresh_token": "eyJ...",
  "expires_in": 86400
}

# Use in requests
GET /api/v1/orders
Authorization: Bearer eyJ...

• Access token: 24 hours (configurable)
• Refresh token: 7 days

API key

Used for service-to-service integrations.

# Create via CLI
rcommerce api-key create --name "My Integration" --scopes "products:read,orders:write"

# Use in requests
GET /api/v1/products
Authorization: Bearer ak_xxxx.yyyy

API keys have fine-grained scopes:

Scope	Access
products:read	Read products
products:write	Create/update products
orders:read	Read orders
orders:write	Create/update orders
customers:read	Read customers
customers:write	Create/update customers
read	Read access to all resources
write	Write access to all resources
admin	Full admin access

Public endpoints

No authentication required:

• GET /api/v1/products — list products
• GET /api/v1/products/:id — get product
• GET /api/v1/categories — list categories
• POST /api/v1/auth/register — create account
• POST /api/v1/auth/login — authenticate
• POST /api/v1/auth/password-reset — request password reset

Token refresh

POST /api/v1/auth/refresh
{ "refresh_token": "eyJ..." }

Returns new access token.

Rate limiting

• Default: 60 requests/minute per IP
• API keys: 1000 requests/minute (configurable)