Skip to main content
POST
Create a checkout intent

Authorizations

Authorization
string
header
required

API Key Authentication

Use your API key in the Authorization header:

Key Types:

Secret Keys (Server-Side Only):

  • Format: tybrite_sk_live_* (production) or tybrite_sk_test_* (sandbox)
  • Full read/write access to all endpoints
  • ⚠️ NEVER expose in client-side code or public repositories
  • Required for: write operations, authentication, payment verification, AI recommendations

Publishable Keys (Client-Safe):

  • Format: tybrite_pk_live_* (production) or tybrite_pk_test_* (sandbox)
  • Read-only access (GET requests only, plus POST semantic search)
  • ✅ Safe for client-side JavaScript, mobile apps, and public code
  • Allowed for: browsing products, search, CMS content, pricing queries

Endpoint-Specific Requirements:

  • Authentication endpoints (/v1/auth/*): Secret key required
  • Payment verification (POST /v1/payments/verify): Secret key required
  • AI Recommendations (POST /v1/recommendations): Secret key required
  • Semantic Search (POST /v1/search): Both key types allowed (read-only operation)
  • All write operations: Secret key required
  • All read operations: Both key types allowed

Using a publishable key for restricted operations returns 403 Forbidden.

Headers

Idempotency-Key
string
required

Unique per intent. A retry with the same key returns the same intent.

Maximum string length: 200
x-auth-token
string

Customer session token from POST /v1/auth/login or POST /v1/auth/verify-otp. Provide exactly one of x-auth-token, x-external-auth, or x-idp-token.

x-external-auth
string

Bring-your-own-auth assertion identifying the customer. Provide exactly one of x-auth-token, x-external-auth, or x-idp-token.

x-idp-token
string

A raw token from the store's own identity provider, verified by the store's configured Auth verifier. Provide exactly one of x-auth-token, x-external-auth, or x-idp-token.

Body

application/json
items
object[]
required
Required array length: 1 - 25 elements
shipping_address
object
required

Where the order is going. country (ISO 3166-1 alpha-2) is needed for tax; line1 with city, or latitude with longitude, for shipping.

confirmation_mode
enum<string>
default:token
Available options:
token,
hosted

Response

A replay of an Idempotency-Key already used with the same items

data
object
required
evidence
object[]
required

Where each figure in data was read from.

computed_at
string<date-time>
required
environment
enum<string>
required
Available options:
production,
sandbox
currency
string | null

ISO 4217 code every amount in data is expressed in.