Get your API key
Every request carries two things: a bearer token that says who you are, and a shop id that says which shop you are acting on. Miss either and you get a 401 or a 403.
1. Create a key
Create and name a credential per integration in Settings → API Keys. Naming them per integration means you can revoke one without breaking the others.
2. Exchange credentials for a token
curl -X POST https://api.tajirpoint.com/api/v1/identity/login/ \
-H "Content-Type: application/json" \
-d '{
"email": "you@yourshop.com",
"password": "••••••••"
}'The response tells you which shops the credential can reach. Pick the one you want and use its id as X-Shop-Id.
{
"user": {
"id": 7,
"email": "you@yourshop.com",
"name": "Ahmed Raza"
},
"shops": [
{
"id": "8f1c2d3e-4b5a-6c7d-8e9f-0a1b2c3d4e5f",
"name": "Gulberg General Store",
"city": "Lahore"
}
],
"tokens": {
"access": "eyJhbGciOiJIUzI1NiIsInR5…",
"refresh": "eyJhbGciOiJIUzI1NiIsInR5…"
}
}3. Call the API
curl https://api.tajirpoint.com/api/v1/catalog/products/ \
-H "Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5…" \
-H "X-Shop-Id: 8f1c2d3e-4b5a-6c7d-8e9f-0a1b2c3d4e5f"Token lifetimes
Access tokens last 30 minutes; refresh tokens last 7 days. A 401 on a request that used to work means the access token expired — exchange the refresh token for a new pair and retry. Do not re-login on every call.
curl -X POST https://api.tajirpoint.com/api/v1/identity/token/refresh/ \
-H "Content-Type: application/json" \
-d '{ "refresh": "eyJhbGciOiJIUzI1NiIsInR5…" }'Keys are secrets. Keep them server-side — anything in a browser bundle or a mobile app is public. The login endpoint is rate-limited to 10 attempts per minute per IP, and the API to 1,000 requests per hour per shop.