Skip to main content
Join Markt’s primary vendor APIs use a session cookie established at login (dash.joinmarkt.com). Browser clients send cookies automatically with same-site requests.

​
Browser / dashboard

  1. Sign in at the dashboard
  2. Call /api/... from the same origin
  3. Include credentials (fetch with credentials: 'include')
CSRF-sensitive mutations follow the app’s existing cookie + header conventions.

​
Server-to-server

For backend jobs, prefer:
  • A trusted server that holds the user session is not recommended long-term
  • Use routes that accept store-scoped secrets where documented (webhooks use provider signatures)
  • Platform admin routes require an admin session
Never embed dashboard session cookies in public clients or third-party scripts.

​
Merchant API keys (Bearer)

For Scriptable, bots, and server integrations, create a key under Account → Developers in the dashboard.
The token must start with mk_live_. Anything else is rejected before a key lookup. Keys are limited to the shops and scopes chosen in the wizard. The scope ids are listed in API keys. On a restricted key, a stored scope satisfies a read route when the stored id is that read id with :read replaced by :write (for example theme:write satisfies theme:read). store:update, product:update, order:update, and the other write ids that are not named :write do not. Merchant routes allow 120 requests per minute per client. Over the limit the response is 429. Outgoing shop events use HMAC X-JoinMarkt-Signature. See Outgoing webhooks. That is separate from payment-provider IPN.

​
Permissions

Dashboard session routes also check store membership and plan entitlements (for example custom domains on Premium+). A 403 on those routes is a missing role or plan, not a bad password.

​
Example