Aroura
API reference
Aroura exposes REST APIs for storefront shopping flows and authenticated merchant operations. All requests should use HTTPS.
Authentication
- Merchant admin APIs require a valid NextAuth session (cookie-based) for platform users.
- Storefront customers sign in via NextAuth (same session cookie as the platform, scoped per host). Subdomain requests authenticate against the store customer table.
- Store context is passed via the x-store-subdomain header or subdomain query parameter on storefront routes.
Storefront — catalog & CMS
- GET /api/storefront/catalog — resolve store, branding, and homepage data.
- GET /api/storefront/products/search — search and filter products.
- GET /api/storefront/cms/pages — list CMS pages.
- GET /api/storefront/cms/blog — list blog posts.
Storefront — cart & checkout
- GET/POST/PATCH/DELETE /api/storefront/cart — manage cart lines.
- POST /api/storefront/cart/estimate — shipping and totals estimate.
- GET /api/storefront/checkout/options — shipping methods and checkout config.
- POST /api/storefront/checkout/place-order — submit an order.
- POST /api/storefront/checkout/track-order — guest order lookup by email + order number.
Storefront — customers
- POST /api/storefront/customer/register — create a store customer account.
- POST /api/auth/signin — customer sign-in on store subdomain (NextAuth credentials + subdomain).
- POST /api/storefront/customer/sync-session — merge guest cart after sign-in.
- GET /api/storefront/customer/me — profile, addresses, and orders.
- POST /api/storefront/customer/check-email — validate email availability for the store.
Merchant admin (authenticated)
- Products: /api/owner-products/* — CRUD, status, and media.
- Orders: /api/owner-orders/* — fetch, update status, fulfillment.
- Customers: /api/owner-customers/* — list and manage store customers.
- Store settings: /api/store-settings/*, /api/store-branding/*.
- Plans & billing: /api/stripe/*, /api/plans/*.
Conventions
- JSON request and response bodies unless noted otherwise.
- Standard HTTP status codes; errors return { message: string }.
- Pagination uses page and limit query parameters where supported.
- Rate limits apply to public endpoints to prevent abuse.
Need more?
Full OpenAPI documentation and webhooks are on the roadmap. For integration support, contact [email protected] with your use case.