Skip to main content
POST
Check out a multi-merchant cart

Authorizations

Authorization
string
header
required

API Key Authentication

Use your API key in the Authorization header:

Key Types:

Secret Keys (Server-Side Only):

  • Format: tybrite_sk_live_* (production) or tybrite_sk_test_* (sandbox)
  • Full read/write access to all endpoints
  • ⚠️ NEVER expose in client-side code or public repositories
  • Required for: every write a shopper does not make for themselves, authentication, payment verification, AI recommendations

Publishable Keys (Client-Safe):

  • Format: tybrite_pk_live_* (production) or tybrite_pk_test_* (sandbox)
  • Catalogue reads, plus the actions a shopper takes for themselves
  • βœ… Safe for client-side JavaScript, mobile apps, and public code
  • Allowed for: browsing products, search, CMS content, pricing queries, cart and wishlist, reviews, storefront events, and the Agent API's quotes, cart drafts and checkout intents

Endpoint-Specific Requirements:

  • Authentication endpoints (/v1/auth/*): Secret key required
  • Payment verification (POST /v1/payments/verify): Secret key required
  • AI Recommendations (POST /v1/recommendations): Secret key required
  • Semantic Search (POST /v1/search): Both key types allowed (read-only operation)
  • Shopper actions (cart, wishlist, reviews, storefront events, Agent API quotes, cart drafts and checkout intents): Both key types allowed
  • All other write operations: Secret key required
  • All read operations: Both key types allowed

Using a publishable key for restricted operations returns 403 Forbidden.

Headers

Idempotency-Key
string

A unique key for this checkout attempt. Repeating the request with the same key and the same body returns the original result with 200; the same key with a different body is refused with 409 idempotency_conflict.

Maximum string length: 255
x-auth-token
string

Session token of a shopper signed in through Galactic Core, tying the checkout to their account rather than treating it as a guest checkout. Optional; send at most one shopper credential.

x-customer-token
string

Alias of x-auth-token.

x-external-auth
string

A shopper assertion signed by the marketplace's own backend with the marketplace's signing secret, for marketplaces that run their own sign-in. The claim carries external_id, iat and exp (at most 300 seconds apart), and optionally email with email_verified: true. Optional; send at most one shopper credential.

Body

application/json
items
object[]
required

The cart line items to check out.

Minimum array length: 1
customer_email
string<email>
required
customer_name
string
customer_phone
string
currency
string

ISO currency code for the order. Defaults to USD.

Example:

"USD"

shipping_address
object

Where the order is going (line1, line2, city, state, postal_code, country). Located to price shipping when shipping_destination is omitted.

shipping_destination
object

Where the basket is going, used to price each merchant's delivery rates. Send coordinates, or a place name. When omitted, the shipping_address is located instead.

shipping_selections
object[]

Optional per-merchant shipping choices: a carrier option (rate_id) returned by POST /v1/cart/checkout/quote. Without one, the merchant's own delivery rate applies.

billing_address
object
wallet_amount
number

Spend up to this much of the signed-in shopper's marketplace wallet on this checkout. Capped by the balance and by the payment provider's minimum charge.

use_wallet
boolean

Spend as much of the signed-in shopper's wallet as the checkout allows.

discounts
object[]

Optional per-merchant discounts. Each entry applies a merchant's own promotion and/or gift card to that merchant's portion of the basket, reducing only that merchant's subtotal. Marketplace-wide promotions run by the operator apply automatically and are not passed here.

attribution
object

Where the shopper came from, recorded so the sale is credited to the right traffic source in the merchant's reports. The same fields are also accepted at the top level of this request body if you already send them that way.

Response

A repeat of an earlier checkout with the same Idempotency-Key and body. The body is the original checkout's result, with the same order_group_id and payment_intent_id.

A created multi-merchant order awaiting payment. Use client_secret to complete the payment on the storefront; the order finalizes automatically once payment succeeds.

order_group_id
string<uuid>

Identifier for the multi-merchant order.

group_number
string

Human-readable reference for the order.

Example:

"MKT-100042"

payment_intent_id
string

Identifier of the payment to complete on the storefront.

client_secret
string

Secret used by the storefront payment form to complete the charge.

currency
string
Example:

"USD"

subtotal
number
Example:

245

total_amount
number

The amount charged β€” the basket after every discount, plus shipping, less wallet_applied.

Example:

245

shipping_total
number

Shipping across every merchant, included in total_amount.

Example:

15

shipping_breakdown
object[]

One shipping line per merchant.

wallet_applied
number

How much of the shopper's marketplace wallet this checkout spends. Held while payment is pending and returned if the payment fails. Funded by the marketplace operator, so each merchant's net is unchanged.

Example:

0

discount_total
number

Total discount applied across the whole basket β€” the sum of every merchant's own promotion and gift card discounts plus any marketplace-wide promotion run by the operator.

Example:

10

operator_funded_discount
number

The portion of discount_total funded by the marketplace operator (for example a marketplace-wide promotion). The remainder is funded by individual merchants.

Example:

5

discount_breakdown
object[]

Per-merchant breakdown of how discounts were applied.

merchant_breakdown
object[]

Per-merchant gross, discount, commission, and net amounts for this order.