REST API reference

Zero-dep CLI mirroring the REST surface. Works with ANYSHOP_API_KEY env. Examples: `anyshop orders list --status paid`, `anyshop products create --title 'Pro' --slug pro --type serial --price-cents 4900 --currency USD`.

Model Context Protocol server. Add to Claude Desktop config with the ANYSHOP_API_KEY env to manage your store conversationally — 10 tools across orders, products, customers, webhooks, and audit.

Verify the API key. Returns shop scoping. Use this to check that an integration is correctly configured before making mutating calls.

curl -H 'Authorization: Bearer as_…' https://anyshop.io/api/whoami

List orders for the authenticated shop. Cursor pagination on createdAt.

curl -H 'Authorization: Bearer as_…' \
  'https://anyshop.io/api/v1/orders?status=paid&limit=20'

Single order with joined line items (product_title, slug, type).

Refund an order. Idempotent — refunding an already-refunded order returns 200 with already_refunded:true. For card orders also calls Stripe Refunds API (Connect-aware, reverses platform fee).

curl -X POST -H 'Authorization: Bearer as_…' \
  https://anyshop.io/api/v1/orders/abc-123/refund

List shop customers. Query: email (case-insensitive exact), limit.

Audit events for the shop. Query: action (exact), since + until (ISO 8601), limit. Useful for compliance pulls and security tooling.

List products. Same status filter shape as orders.

Single product.

Partial update. Strict body — unknown fields rejected with 422. Allowed: title, description, price_cents, currency, status, delivered_message, stock_total. Audited as product.edited with the changed field list.

Destroy a product. License keys cascade. Returns 409 in_use on FK conflict (active orders).

Create a product. Defaults: status=draft, stock_total=-1 (unlimited). Returns 201, 409 slug_taken on conflict, 422 with validation details on bad body.

{
  "title": "Pro license",
  "slug": "pro",
  "type": "serial",            // serial | file | service | subscription
  "price_cents": 4900,
  "currency": "USD",
  "description": "Optional markdown.",
  "stock_total": -1,           // -1 = unlimited
  "delivered_message": "Optional message shown to buyers",
  "status": "draft"            // or "active"
}

curl -X POST https://anyshop.io/api/v1/products \
  -H 'Authorization: Bearer as_…' \
  -H 'Content-Type: application/json' \
  -d '{"title":"Pro","slug":"pro","type":"serial","price_cents":4900,"currency":"USD"}'

List webhook subscriptions for the shop.

Create a webhook subscription. Body: { url, events: [...] }. Response includes signing_secret EXACTLY ONCE — store it; we never return it again.

{
  "url": "https://your-service.example.com/anyshop",
  "events": ["order.paid", "order.fulfilled", "subscription.renewed"]
}

Destroy a webhook subscription.

We POST signed events to subscribed URLs. Header X-Anyshop-Signature: t=<unix>,v1=<hex>. The signature is HMAC-SHA256 over the raw request body using the signing_secret shown once when you created the webhook at /dashboard/developer.

// Verify with @anyshop/webhooks
import { verify } from '@anyshop/webhooks';
const body = await req.text();
const sig = req.headers.get('x-anyshop-signature');
if (!verify(body, sig, signingSecret)) {
  return new Response('Bad signature', { status: 400 });
}
const event = JSON.parse(body);