API reference

Authentication

Server calls use short-lived bearer tokens issued to a registered app. Embedded browser code uses a one-time install-session exchange and never receives the client secret.

POST /api/app-platform/token
Content-Type: application/json

{
  "clientId": "jotify_…",
  "clientSecret": "read-once-secret",
  "scope": "site:read site:content:write"
}

Version every request

Send X-Jotify-Api-Version: 2026-08. Future stable versions use date-based identifiers and retain an overlap window before retirement.

const client = new JotifyApiClient({
  baseUrl: 'https://jotify.com',
  accessToken: process.env.JOTIFY_ACCESS_TOKEN
});

const identity = await client.get('/api/app-platform/me');

Errors and retries

Treat 401 and 403 as credential or consent failures, 409 as a state conflict, 429 as backpressure and 5xx as retryable only for idempotent operations.

• Use exponential backoff with jitter.
• Honor Retry-After.
• Log the returned request ID, never tokens or personal data.
• Use an idempotency key for create or billing-like operations.

CLI version endpoints

Development credentials may manage only their own app versions. Draft uploads cannot activate distribution, overwrite a submitted version or read another app’s versions.

GET  /api/app-platform/versions
POST /api/app-platform/versions
POST /api/app-platform/versions/rollback

OAuth endpoints

User authorization uses an exact registered redirect, explicit consent, single-use authorization codes and mandatory PKCE S256. Access and refresh tokens are stored only as hashes.

POST /api/app-platform/oauth/authorize
POST /api/app-platform/oauth/token
GET  /api/app-platform/oauth/me
POST /api/app-platform/oauth/revoke

Read-only Website and Store resources (preview)

OAuth apps with an active approved Website or Store install can enumerate only the builder resources owned by the signed-in user. The response contains names, slugs, status and timestamps—not page bodies, orders, customer data or payment data.

GET /api/app-platform/resources?kind=site
Authorization: Bearer joa_…
X-Jotify-Api-Version: 2026-08

Availability boundary

The install, credential, version, review and embedded-session contract exists today. Product data APIs listed as planned or restricted are documentation of the target architecture—not a claim that third parties can call them yet.