Authentication

Staff session tokens

Tenant staff log in via /api/v1/login (or Google / passkeys) and receive a Sanctum bearer token with ability staff. Use it for admin SPA and staff automation.

Admin API keys (agents)

For MCP and headless automation, create a scoped key under Settings → AI Agents:

Format: msh_ + random characters (shown once)
Abilities include agent plus scopes such as products:read, products:write, orders:read, orders:manage, settings:read, settings:write, storefront:read, storefront:write

Pass the key as Authorization: Bearer msh_….

Customer tokens

Storefront customers authenticate with the customer guard (/customer/login and related OTP flows). Do not reuse staff tokens on customer routes.