Authentication

Every request carries your API key as a bearer token in the Authorization header.

curl https://gateway.shirtee.cloud/api/orders \
  -H "Authorization: Bearer $SHIRTEE_API_KEY"

Put the token from your secret management into the environment variable and never hard-code it in a command or script.

The spec is public

You do not need a key for the OpenAPI spec:

curl https://gateway.shirtee.cloud/public/merchant-api/openapi.json

It contains exactly the operations a merchant key can reach and lists, per operation in x-customer-scopes, the permissions of which your key needs at least one. A merchant key is rejected with 403 on every other interface.

Telling 401, 403 and 404 apart

Status	Message (detail)	Meaning	What to do
401	Authentication required	The header is missing or the token is invalid or expired. The message is the same in all three cases.	Check header and token, look up the expiry date in the portal, create a new key if needed
403	No permission to access this resource	The key is valid, but none of its effective permissions fits the endpoint, or the endpoint is not open to merchant keys.	Decision tree under Scopes and enablement
403	Scoped API key revoked	The key was revoked.	Create a new key
404	Not Found or similar	The resource does not exist or belongs to another account.	Check the ID

Foreign resources deliberately return 404 instead of 403, so the API does not reveal whether a foreign order exists.

Error format

All errors share one shape, see Errors.