Mystoq Developer API

Quickstart

Three steps from zero to your first programmatic order:

1. Create an API key from Dashboard → Developers (choose the read or write scope).
2. Send the key in the Authorization: Bearer header on every request.
3. Call GET /v1/products, then register a Webhook URL to receive events.

Introduction

The Mystoq API is RESTful, returns JSON, and is secured with API keys. Every request runs strictly within your own store (full tenant isolation). Create your key from Dashboard → Developers.

Authentication

Pass your key in the Authorization header as a Bearer token. Keys look like msq_<prefix>_<secret>; the secret part is shown only once, at creation.

# Every request needs this header
Authorization: Bearer msq_ab12cd34_your_secret_here

Base URL & limits

Products

Lists your store’s published products (status = active), paginated.

Query parameters (optional)

# Example
curl "https://mystoq.com/api/v1/products?per_page=2&search=jacket" \
  -H "Authorization: Bearer msq_ab12cd34_secret" \
  -H "Accept: application/json"

// Response
{
  "data": [
    { "id": 1027, "name": "Women's jacket", "slug": "womens-jacket",
      "price": 2000, "compare_price": 2800, "sku": "JCK-01",
      "stock": 100, "status": "active", "category_id": 4,
      "images": ["https://…/p1.jpg"] }
  ],
  "meta": { "current_page": 1, "per_page": 2, "total": 57, "last_page": 29 }
}

A single product. Returns 404 if not found or not published.

Orders

Lists your store’s orders (paginated, newest first).

Query parameters (optional)

A single order with its items and customer details.

// Order response
{
  "data": {
    "id": 5821, "reference": "ORD-5821", "status": "pending",
    "payment_method": "cod", "payment_status": "unpaid",
    "subtotal": 2000, "shipping_cost": 500, "discount": 0, "total": 2500,
    "delivery_type": "home", "wilaya_id": 16, "commune": "Bab Ezzouar",
    "customer": { "name": "Ahmed Ben Ali", "phone": "0555123456" },
    "items": [ { "product_id": 1027, "name": "Women's jacket", "price": 2000, "qty": 1, "total": 2000 } ],
    "created_at": "2026-07-18T20:00:00Z"
  }
}

Create an order

Create an order programmatically. Requires a key with the write scope. The order passes through all store rules: server-side price recalculation, stock reservation and per-wilaya shipping fees.

Request body

curl -X POST "https://mystoq.com/api/v1/orders" \
  -H "Authorization: Bearer msq_ab12cd34_secret" \
  -H "Content-Type: application/json" \
  -d '{
    "customer": { "name": "Ahmed Ben Ali", "phone": "0555123456", "wilaya_id": 16, "commune": "Bab Ezzouar" },
    "items": [ { "product_id": 1027, "qty": 1 } ],
    "payment_method": "cod",
    "delivery_type": "home"
  }'

Webhooks

Register an https URL in the dashboard to receive instant POST notifications when events occur.

// Payload sent to your URL
{
  "event": "order.created",
  "created_at": "2026-07-11T20:00:00Z",
  "data": {
    "id": 5821, "reference": "ORD-5821", "status": "pending",
    "total": 2500, "customer": { "name": "Ahmed", "phone": "0555…" }
  }
}

Verifying signatures

Every Webhook carries an X-Mystoq-Signature header = sha256=HMAC(secret, rawBody). Verify it to confirm the request is from Mystoq and the body was not tampered with.

// Node.js — verification example
const crypto = require("crypto");
const expected = "sha256=" +
  crypto.createHmac("sha256", SECRET).update(rawBody).digest("hex");
if (expected === req.headers["x-mystoq-signature"]) { /* trusted */ }

Errors