Website API

One API for every Meshkee business website. Not tied to a single domain. Set your site’s apex host (e.g. sanihome.ir) and reuse the same endpoints.

Base URL

https://api.meshkee.com/api/v1

Optional per-site alias (same backend): https://api.<domain>/api/v1

How tenants work

1. Variable domain = website apex only (no www/api/customer/business).
2. GET /tenants/{domain} → businessId.
3. Public pages: /tenants/{domain}/... (no auth) — products, user-products, blogs, portfolios, store-items, etc.
4. Favorites (optional, if cookies exist): /businesses/{businessId}/... + Bearer JWT.
5. Login, checkout, server cart, orders: customer dashboard at https://customer.{domain} — not pages on the shop.

Shared login with customer dashboard

Do not build a login / register / OTP page on the storefront. Send shoppers to https://customer.{domain}/login. The customer dashboard writes parent-domain cookies; the shop only reads them to detect an existing session:

• meshkee_customer_access_token
• meshkee_customer_refresh_token

Set Domain=.{domain}, Path=/, SameSite=Lax. API auth is still Authorization: Bearer <accessToken> (cookies are not sent to the API). Do not use /auth/handoff for shoppers (staff-only into the business dashboard). Full detail: AI_PROMPT.md.

Shopping cart on the storefront

The shop implements a mini-cart only: header icon, quantity badge, popup, Continue. Persist a guest cart as meshkee-guest-cart (localStorage + parent-domain cookie). Each line id is storeItemVariantId. Add-to-cart: GET /tenants/{domain}/store-items/by-product/{productId}, list variants if there is more than one, then add the chosen variant (same id already in cart → increment quantity). Continue goes to the customer dashboard:

• Logged in → https://customer.{domain}/checkout/cart?guestCart=…
• Not logged in → https://customer.{domain}/login?redirect=/checkout/cart?guestCart=…

Do not call /cart or /cart/checkout from the website, and do not add shop /login or /checkout routes. Encoding and payload: AI_PROMPT.md (Shopping cart).

Branding (favicon + logos)

GET /tenants/{domain}/website/favicon returns faviconUrl, logoUrl, logoDarkUrl, and hasDedicatedFavicon. Use faviconUrl for the browser tab icon (Next.js metadata.icons). When no dedicated favicon is uploaded, faviconUrl falls back to logoUrl.

User products (customer listings)

Marketplace-style stock listings created by customers. Public read-only under /tenants/{domain}/user-products (list / by-id / details / technical-info). Storefront URLs: /user-products/{id}/{pathSlug}. See OpenAPI tag User Products.

Technical details: detail responses include technicalValues with values only (no field labels). For a label→value specs table, call GET /tenants/{domain}/user-products/by-id/{id}/technical-info (catalog products: .../products/by-id/{id}/technical-info) and join form.fields[].id ↔ values[].fieldId. There is no public product-category-variation-fields route.

Torob (price comparison)

POST /tenants/{domain}/torob_api/v3/products is for Torob, not storefront JavaScript. On the live shop, nginx proxies POST https://{domain}/torob_api/v3/products to that API. It only returns catalog store items when the business has the store module enabled and Store settings → Torob is on; otherwise 404. Do not implement this path in Next.js.

For a new website AI / designer

1. Open AI_PROMPT.md and paste it into the AI chat.
2. Replace <WEBSITE_DOMAIN> with that site’s apex.
3. Import the Postman collection (set domain, run Resolve tenant).
4. Or feed openapi.json to the AI / codegen tool.

Import Postman

Postman → Import → Link → paste
https://api.meshkee.com/docs/website/Meshkee-Website-API.postman_collection.json

Partner SMS gateway

External backends (e.g. Balout) can send transactional SMS through Meshkee → Gama. Server-to-server only — API key per allowlisted domain. See SMS.md.