Base URL
Dashboard session routes:/api/merchant/v1.
Response shape
Successful JSON responses usually return a payload object (sometimes wrapped). Errors return HTTP status codes with a human-readableerror field (theme cart routes use message); dashboard and Merchant API errors add success: false and a machine-readable code. Always check status before parsing. See Response format, Errors, and Rate limits.
Versioning
Dashboard session routes use unversioned paths (/api/dashboard/..., /api/orders, etc.).
Merchant integrations use:
Authorization: Bearer mk_live_<secret>. Session cookies are not accepted. The secret is the value shown once when the key is created or rotated (mk_live_ plus the generated token).

