For AI agents: the complete documentation index is at https://webshop-docs.acmewebshop.com/llms.txt. Every page is also available as Markdown by appending index.md to its URL or by sending Accept: text/markdown.
Acme Webshop API

Authentication

The Acme Webshop API uses bearer tokens. You log in once, receive a short-lived token, and send it on every subsequent request.

Public vs. authenticated endpoints

Access Endpoints
Public — no token POST /auth/login, GET /products, GET /products/{productId}
Bearer token required Everything else — orders, customers, product writes

The token flow

sequenceDiagram
    autonumber
    participant App as Your app
    participant API as Acme Webshop API
    App->>API: POST /auth/login { email, password }
    API-->>App: 200 { token, expiresIn: 3600 }
    App->>API: GET /orders — Authorization: Bearer <token>
    API-->>App: 200 order list
    Note over App,API: After expiresIn seconds the token is rejected with 401 — log in again.

1 — Obtain a token

curl -X POST 'https://api.acmewebshop.com/v2/auth/login' \
  -H 'Content-Type: application/json' \
  -d '{ "email": "you@example.com", "password": "…" }'
{
  "token": "eyJhbGciOiJIUzI1NiIs…",
  "expiresIn": 3600
}

2 — Use it

Send the token in the Authorization header:

curl 'https://api.acmewebshop.com/v2/orders?status=paid' \
  -H 'Authorization: Bearer eyJhbGciOiJIUzI1NiIs…'

Failure modes

Status Meaning What to do
401 with code INVALID_CREDENTIALS Wrong email or password on login Check the credentials
401 on any other endpoint Token missing, malformed or expired Log in again, retry the request

Tokens are valid for one hour (expiresIn: 3600). Refresh proactively: re-login when less than a minute remains rather than retrying on the first 401.