Getting started

Get your API key

Every request carries two things: a bearer token that says who you are, and a shop id that says which shop you are acting on. Miss either and you get a 401 or a 403.

1. Create a key

Create and name a credential per integration in Settings → API Keys. Naming them per integration means you can revoke one without breaking the others.

2. Exchange credentials for a token

cURL — log in
curl -X POST https://api.tajirpoint.com/api/v1/identity/login/ \
  -H "Content-Type: application/json" \
  -d '{
    "email": "you@yourshop.com",
    "password": "••••••••"
  }'

The response tells you which shops the credential can reach. Pick the one you want and use its id as X-Shop-Id.

JSON — 200
{
  "user": {
    "id": 7,
    "email": "you@yourshop.com",
    "name": "Ahmed Raza"
  },
  "shops": [
    {
      "id": "8f1c2d3e-4b5a-6c7d-8e9f-0a1b2c3d4e5f",
      "name": "Gulberg General Store",
      "city": "Lahore"
    }
  ],
  "tokens": {
    "access": "eyJhbGciOiJIUzI1NiIsInR5…",
    "refresh": "eyJhbGciOiJIUzI1NiIsInR5…"
  }
}

3. Call the API

cURL — authenticated request
curl https://api.tajirpoint.com/api/v1/catalog/products/ \
  -H "Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5…" \
  -H "X-Shop-Id: 8f1c2d3e-4b5a-6c7d-8e9f-0a1b2c3d4e5f"

Token lifetimes

Access tokens last 30 minutes; refresh tokens last 7 days. A 401 on a request that used to work means the access token expired — exchange the refresh token for a new pair and retry. Do not re-login on every call.

cURL — refresh
curl -X POST https://api.tajirpoint.com/api/v1/identity/token/refresh/ \
  -H "Content-Type: application/json" \
  -d '{ "refresh": "eyJhbGciOiJIUzI1NiIsInR5…" }'

Keys are secrets. Keep them server-side — anything in a browser bundle or a mobile app is public. The login endpoint is rate-limited to 10 attempts per minute per IP, and the API to 1,000 requests per hour per shop.