Skip to content

Quickstart

This guide gets you from zero to your first authenticated response. Pick the API that matches what you’re building:

  • Store API — customer-facing commerce (catalogue, shipping, orders, webhooks). Uses OAuth 2.1.
  • Creator API — creator earnings and catalogue management. Uses a bearer JWT.
  1. Register a client. Get a client_id via dynamic client registration (POST /api/auth/oauth2/register) or by asking elasticStage. Public clients (SPAs, native apps) use PKCE and receive no client secret.

  2. Get an access token. Run the Authorization Code + PKCE flow against the authorization server. See Authentication for the full flow; the short version:

    GET https://auth.staging.elasticstage.com/api/auth/oauth2/authorize
    ?response_type=code
    &client_id=YOUR_CLIENT_ID
    &redirect_uri=YOUR_REDIRECT_URI
    &scope=openid%20releases:read%20orders:read%20orders:create%20offline_access
    &code_challenge=BASE64URL_SHA256_OF_VERIFIER
    &code_challenge_method=S256

    Exchange the returned code at the token endpoint for an access_token.

  3. Call the API. Send the token as a bearer credential. The storefront is mounted under /store on the shared API gateway:

    Terminal window
    curl https://api.staging.elasticstage.com/store/v1/creator \
    -H "Authorization: Bearer $ACCESS_TOKEN"
  4. List releases.

    Terminal window
    curl https://api.staging.elasticstage.com/store/v1/releases \
    -H "Authorization: Bearer $ACCESS_TOKEN"
  1. Obtain a bearer token for the Creator API audience from the elasticStage authorization server (creator dashboards and label tooling mint these).

  2. List the creators you can see. The response is paginated (meta.page / meta.per_page / meta.total):

    Terminal window
    curl https://api.staging.elasticstage.com/creator/api/v1/creators \
    -H "Authorization: Bearer $ACCESS_TOKEN"
  3. Read royalty stats for a creator (money is returned in integer minor units, e.g. 1099 = £10.99):

    Terminal window
    curl "https://api.staging.elasticstage.com/creator/api/v1/creators/$UUID/stats/royalties" \
    -H "Authorization: Bearer $ACCESS_TOKEN"

Every service exposes unauthenticated liveness and readiness probes — handy for confirming connectivity before you wire up auth:

Terminal window
# Store API
curl https://api.staging.elasticstage.com/store/health/ready
# Creator API
curl https://api.staging.elasticstage.com/creator/health/ready