API Documentation

Create an account with email, username, and password. Sends a verification email.

{
  "email": "buyer@email.com",
  "username": "buyer",
  "password": "s3cret!",
  "confirmPassword": "s3cret!"
}

Send a password-reset token to the user's email.

Complete a password reset using the emailed token.

Verify an email address from the link sent during registration.

End the current session and clear the auth cookie.

Return the current session (NextAuth). Used by the client to know if a user is signed in.

Get the authenticated user's profile.

Update display name, bio, social links, and privacy settings.

List the user's wishlisted products.

Add a product to the wishlist. Body: { productId }.

Remove a product from the wishlist.

List published products with filters. Query: category, search, sort, page, limit, priceMin, priceMax, rating, tags, free, onSale, creator.

GET /api/products?category=avatars&sort=price-asc&page=1&limit=24
{
  "products": [ { "id": "cld...", "title": "Neon Fox", "price": 12.0, "rating": 4.7 } ],
  "pagination": { "page": 1, "limit": 24, "total": 318, "totalPages": 14 }
}

Get full product details including media, files, reviews, and creator.

Create a product (creator only). Handles slug generation and tag upserts.

Admin-curated featured products for the homepage.

Paginated, verified reviews for a product with average rating.

Upload images/videos. Returns a CDN URL and generates a thumbnail.

Attach downloadable files to a product (drag-and-drop, resumable).

Delete a media asset.

Get the current cart (user or guest session).

Add a product to the cart. Body: { productId, quantity }.

Update an item's quantity (min 1, max 100).

Remove an item from the cart.

Apply a coupon code. Body: { code }.

Create a Stripe Checkout session for the cart. Returns orderId and Stripe URL.

POST /api/checkout
{ "cartId": "cld...", "couponCode": "SUMMER10" }
→ { "orderId": "ord...", "url": "https://checkout.stripe.com/..." }

List the user's orders with items, payments, and licenses.

Request a refund. Body: { reason, items? }. Creates a PENDING refund and notifies the buyer.

List the user's (or, for admins, all) license keys with product info.

Generate a license for a completed order. Body: { productId, orderId, userId?, expiresAt? }.

Public validation. Checks existence, revocation, and expiry. Rate-limited to 100 req/min.

GET /api/licenses/validate?key=PV-AB12-CD34-EF56
{
  "valid": true,
  "license": { "key": "PV-AB12-CD34-EF56", "status": "ACTIVE", "product": { "slug": "neon-fox" } }
}

Create a review. Verified flag is set if the user owns the product. Body: { productId, rating, title?, content? }.

Edit your review (within 30 days).

Delete your review (within 30 days).

List the user's notifications plus an unreadCount. Add ?unread=true to filter.

Mark a notification as read.

Delete a notification.

Full-text search across products and creators. Query: q, type (all|products|creators), limit, offset.

GET /api/search?q=fox&limit=5
{
  "products": [ { "title": "Neon Fox", "slug": "neon-fox" } ],
  "creators": [ { "username": "foxtail" } ]
}

Top creators ranked by recent sales and followers.

All categories with product counts.

A single category with its products and subcategories.

Public storefront data: products, collections, and reviews summary.