> ## Documentation Index
> Fetch the complete documentation index at: https://docs.joinmarkt.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> Session cookies for the dashboard and how server-to-server calls should authenticate.

Join Markt’s primary vendor APIs use a **session cookie** established at login (`dash.joinmarkt.com`). Browser clients send cookies automatically with same-site requests.

## Browser / dashboard

1. Sign in at the dashboard
2. Call `/api/...` from the same origin
3. Include credentials (`fetch` with `credentials: 'include'`)

CSRF-sensitive mutations follow the app’s existing cookie + header conventions.

## Server-to-server

For backend jobs, prefer:

* A trusted server that holds the user session is **not** recommended long-term
* Use routes that accept store-scoped secrets where documented (webhooks use provider signatures)
* Platform admin routes require an admin session

Never embed dashboard session cookies in public clients or third-party scripts.

## Merchant API keys (Bearer)

For Scriptable, bots, and server integrations, create a key under **Account → Developers** in the dashboard.

```bash theme={null}
curl "https://dash.joinmarkt.com/api/merchant/v1/stores/{storeId}/analytics" \
  -H "Authorization: Bearer mk_live_<your_key>" \
  -H "Accept: application/json"
```

The token must start with `mk_live_`. Anything else is rejected before a key lookup.

Keys are limited to the shops and scopes chosen in the wizard. The scope ids are listed in [API keys](https://docs.joinmarkt.com/developers/api-keys.md). On a restricted key, a stored scope satisfies a read route when the stored id is that read id with `:read` replaced by `:write` (for example `theme:write` satisfies `theme:read`). `store:update`, `product:update`, `order:update`, and the other write ids that are not named `:write` do not.

Merchant routes allow 120 requests per minute per client. Over the limit the response is `429`.

| Status | Meaning |
| - | - |
| 401 | Missing, malformed, unknown, revoked, or expired key, or the account is deleted |
| 403 | Shop is outside the key, the scope does not match, or the key owner lacks that shop permission |

Outgoing shop events use HMAC `X-JoinMarkt-Signature`. See [Outgoing webhooks](https://docs.joinmarkt.com/developers/outgoing-webhooks.md). That is separate from [payment-provider IPN](https://docs.joinmarkt.com/developers/webhooks.md).

## Permissions

Dashboard session routes also check **store membership** and **plan entitlements** (for example custom domains on Premium+). A `403` on those routes is a missing role or plan, not a bad password.

## Example

```bash theme={null}
curl https://dash.joinmarkt.com/api/dashboard/bootstrap \
  -H "Cookie: <your-session-cookie>" \
  -H "Accept: application/json"
```


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.