Help / Developers

Authentication

Call the API with a shop's API key. Each key has scopes and acts as one member of the shop.

API keys #

A shop's API key is a Matih API key. It belongs to one shop and acts as one member of that shop. Send it as a bearer token:

curl "$TEJAS_API/api/2026-11/transactions?limit=10" \
  -H "Authorization: Bearer $TEJAS_API_KEY"

$TEJAS_API is the API address of your shop's Tejas, and $TEJAS_API_KEY is your key. Keep the key on your server. Never put it in a web page or an app.

Scopes #

Scope	Lets the key
`orders:read`	List and read orders, their history, the approval settings and Tejas's fee invoices.
`orders:write`	Everything that changes an order: confirm, reject, pack, fulfil, refund, edit, placing for a customer, and the approval settings and storefront.
`buyers:read`	List and find the shop's customers.
`buyers:write`	Onboard a customer and set a customer's cart.
`catalog:read`	Browse what the shop offers, as a customer sees it.

A change needs the write scope for its kind. A key with only orders:read can read orders and nothing else. Three more scopes, catalog:write, stock:read and stock:write, belong to catalog and stock endpoints that are not published yet. The routes and tools below keep the word "transactions" in their names: an order is a transaction in a path or a tool name.

A key can never do more than the member it acts as. The scope narrows the member's role and never widens it.

Roles #

A key acts as a member of the shop. Tejas checks that member's role on every call, on every door. The checks are:

Check	Needed for
`transactions.view`	Reads.
`transactions.decide`	Confirm, reject, accept, refuse, edit.
`transactions.fulfil`	Pack and fulfil.
`transactions.buyer_add`	Onboard a customer.
`transactions.settings`	Change the approval settings and the storefront.

Refunds and marking a payment need the role's money permissions. A call the role may not make is 403 with the category no_permission.

Another shop's data #

A key sees only its own shop. A transaction or customer of another shop gets the same 404 as one that does not exist.

Did this page help?

Last checked: 2026-11-07