Store API

A read-only REST API over this store's bundle data, for your own scripts, dashboards and integrations. Every endpoint a merchant token can reach is a GET, and each token belongs to one store.

If what you want is an AI assistant that answers questions about the store, you want MCP instead. This surface is for code you write.

The same token as MCP

This is the one place this API differs from what you may expect: there is no separate API key. The token you create for an AI client is the same token you use here, and it grants exactly the same thing on both surfaces.

Create one in Settings → Integrations — see Authentication. Revoking a connection stops both at once.

Your first request

curl "https://avada-bundle-upsell.firebaseapp.com/public-api/shop/YOUR-STORE.myshopify.com/status" \
  -H "Authorization: Bearer aovmcp_YOUR_TOKEN"

const base =
  'https://avada-bundle-upsell.firebaseapp.com/public-api/shop/YOUR-STORE.myshopify.com';
 
const res = await fetch(`${base}/offers?status=active&limit=50`, {
  headers: {Authorization: 'Bearer aovmcp_YOUR_TOKEN'}
});
const {success, data, message} = await res.json();

The response shape

{"success": true, "data": { }}

On failure, success is false and message carries a human-readable reason:

{"success": false, "message": "This token is read-only"}

Read-only, enforced by method

The rule is the HTTP method itself: a merchant token is refused on anything that is not a GET, with 403 This token is read-only. There is no scope, no permission, and nothing you can be granted that lifts it — so a token in a script cannot create, change or delete an offer even by accident.

Never call this from a browser

The API sends permissive CORS headers, so a request from browser JavaScript will succeed. That is there for server-side tools and local development, not for your storefront.

Limits

Requests are counted before the token is resolved, so a flood of bad tokens is throttled too. The budget is per token, so one integration cannot spend another's — give each script its own.

Read X-RateLimit-Remaining rather than counting requests yourself. It is on every response, including successful ones.

What is never returned

• No customer data. No names, emails, addresses, or individual orders. Analytics are aggregates over a date range.
• No credentials. The Shopify access token and its hash are stripped from every response.
• No support-session or contact fields. GET /status returns a fixed allowlist of fields, so a field added to the store record later does not start appearing here on its own.
• No theme source. Reading theme files is not available to a merchant token.
• No write access. Every non-GET request is refused.

Where next

• Endpoints — everything a token can call
• Errors — every refusal, and what to do about it
• MCP tool guide — what the fields mean, in more depth