Skip to main content

​
Welcome

Join Markt exposes HTTP JSON APIs from your deployment origin. Unlike platforms that publish a single OAuth2 admin API, Join Markt splits traffic by trust boundary:

​
Base URL

Examples use absolute paths from that origin. Storefront HTML is also served on:
Checkout invoices live at /checkout/{orderId} and are excluded from subdomain rewrite rules — always link to the app origin for checkout, not /store/{subdomain}/checkout/....

​
What is documented here

This reference prioritizes integrator-facing routes:
  • Embed checkout
  • Checkout start / client gate
  • Public storefront catalog
  • Coupon validation
  • Order delivery / keys
  • Page-view tracking
  • Incoming payment webhooks (overview)
Dashboard CRUD for products, tickets, team, and analytics exists under /api/* with session auth. Those handlers are thin wrappers over lib/domains/* and follow the same permission matrix as the UI (viewOrders, manageCoupons, manageSettings, …). Documented endpoint pages are added where external developers commonly integrate; the rest follow the same patterns as the open-sourced route handlers.

​
Conventions

  • Validate input with Zod at the route / domain boundary.
  • Prefer { error: string } on failure for public routes (some order errors spread extra payload keys).
  • Rate limits use rateLimit(identifier, { maxRequests, windowMs }) keyed by client IP / forwarded identity.
  • CSRF tokens apply when requireSession / requireAdmin runs — not on pure public checkout routes.

​
Next

  1. Quick Start — first successful public call
  2. Authentication — sessions vs public vs webhooks
  3. Rate limiting — budgets that will page you at 2am
  4. Pick an endpoint group: Catalog, Checkout, Embed