Developer API

RentedMall exposes a versioned HTTP API under /api/v1. Business logic lives in domain modules; route handlers stay thin. Public DTOs never expose raw database models.

Authentication

Seller dashboard sessions via Supabase Auth (cookie-based).
Storefront customer sessions via store-scoped tokens.
Store API keys: Authorization: Bearer ap_<keyId>_<secret> on /api/v1/open with scoped permissions and rate limits.

Core surfaces

/api/v1/open?resource=... — public store API (products, orders, inventory…)
/api/v1/stores/:id/integrations — API keys, webhooks, Telegram, suppliers
/api/v1/finance — balance, deposits, gateway, escrow
/api/v1/webhooks/payments/:provider — inbound payment webhooks
/api/v1/webhooks/telegram/:storeId — Telegram Bot updates

Outbound webhooks

Signed with X-RentedMall-Webhook-Signature: t=<ts>,v1=<hmac>. Verify timestamp tolerance to reject replays. Events include order.paid, payment.succeeded, fulfillment.completed, and more.

Conventions

problem+json errors with request IDs
Server-side tenant authorization on every sensitive route
Idempotency keys for checkout and financial side effects
Cross-tenant denials return identical not-found responses
Money as integer minor units only — never floating point