> ## Documentation Index
> Fetch the complete documentation index at: https://docs.stella-commerce.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Create Storefront Token

> Mint a new storefront token. The plaintext `secret` in the
response is shown exactly once — store it immediately.

If `scopes` is omitted, all four default-on scopes are granted.
If `allowed_origins` is omitted, the token is unrestricted by
origin (recommended only for server-side use).



## OpenAPI

````yaml /api-reference/openapi.json post /api/dashboard/storefront-tokens
openapi: 3.1.0
info:
  title: Agentic Commerce API
  description: |2-

        Agentic Commerce API - E-commerce Backend

        ## APIs

        ### Dashboard API (`/api/dashboard`)
        Authenticated endpoints for merchant management:
        - Products, Variants, Options
        - Inventory management
        - Orders and fulfillment
        - Customers
        - Collections

        ### Storefront API (`/api/storefront`)
        Public endpoints for client websites:
        - Product catalog
        - Collections
        - Cart management
        - Checkout

        ### Sync API (`/api/sync`)
        Integration endpoints for zunkiree-search:
        - Product sync
        - Availability checks
        - Order creation from AI widget
        
  version: 1.0.0
servers: []
security: []
paths:
  /api/dashboard/storefront-tokens:
    post:
      tags:
        - Dashboard
        - Storefront Tokens
      summary: Create Storefront Token
      description: |-
        Mint a new storefront token. The plaintext `secret` in the
        response is shown exactly once — store it immediately.

        If `scopes` is omitted, all four default-on scopes are granted.
        If `allowed_origins` is omitted, the token is unrestricted by
        origin (recommended only for server-side use).
      operationId: create_storefront_token_api_dashboard_storefront_tokens_post
      parameters:
        - name: authorization
          in: header
          required: false
          schema:
            anyOf:
              - type: string
              - type: 'null'
            title: Authorization
        - name: X-API-Key
          in: header
          required: false
          schema:
            anyOf:
              - type: string
              - type: 'null'
            title: X-Api-Key
        - name: X-Stella-Merchant-Id
          in: header
          required: false
          schema:
            anyOf:
              - type: string
              - type: 'null'
            title: X-Stella-Merchant-Id
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/StorefrontTokenCreateRequest'
      responses:
        '201':
          description: Successful Response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/StorefrontTokenCreatedResponse'
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
components:
  schemas:
    StorefrontTokenCreateRequest:
      properties:
        name:
          anyOf:
            - type: string
              maxLength: 255
            - type: 'null'
          title: Name
          description: Human label for this token, e.g. 'Kasa production'.
        scopes:
          anyOf:
            - items:
                type: string
              type: array
            - type: 'null'
          title: Scopes
          description: >-
            Subset of allowed scopes. If omitted, all four default-on scopes are
            granted: ['cart:write', 'catalog:read', 'checkout:create',
            'customer:auth'].
        allowed_origins:
          anyOf:
            - items:
                type: string
              type: array
            - type: 'null'
          title: Allowed Origins
          description: >-
            Browser origins allowed to use this token (e.g.
            ['https://kasa.com']). Empty list means any origin (server-side use
            only is recommended in that case).
      type: object
      title: StorefrontTokenCreateRequest
    StorefrontTokenCreatedResponse:
      properties:
        id:
          type: string
          format: uuid
          title: Id
        key_id:
          type: string
          title: Key Id
        secret_prefix:
          type: string
          title: Secret Prefix
        name:
          anyOf:
            - type: string
            - type: 'null'
          title: Name
        scopes:
          items:
            type: string
          type: array
          title: Scopes
        allowed_origins:
          items:
            type: string
          type: array
          title: Allowed Origins
        created_at:
          type: string
          format: date-time
          title: Created At
        last_used_at:
          anyOf:
            - type: string
              format: date-time
            - type: 'null'
          title: Last Used At
        revoked_at:
          anyOf:
            - type: string
              format: date-time
            - type: 'null'
          title: Revoked At
        secret:
          type: string
          title: Secret
          description: >-
            The plaintext storefront secret (`stk_sec_<...>`). Returned only at
            creation time; not recoverable later.
      type: object
      required:
        - id
        - key_id
        - secret_prefix
        - name
        - scopes
        - allowed_origins
        - created_at
        - last_used_at
        - revoked_at
        - secret
      title: StorefrontTokenCreatedResponse
      description: |-
        Response from `POST /storefront-tokens`. The `secret` field
        (`stk_sec_<...>`) is shown exactly once and is not recoverable
        from the server afterwards. Dashboards must surface this clearly.
    HTTPValidationError:
      properties:
        detail:
          items:
            $ref: '#/components/schemas/ValidationError'
          type: array
          title: Detail
      type: object
      title: HTTPValidationError
    ValidationError:
      properties:
        loc:
          items:
            anyOf:
              - type: string
              - type: integer
          type: array
          title: Location
        msg:
          type: string
          title: Message
        type:
          type: string
          title: Error Type
        input:
          title: Input
        ctx:
          type: object
          title: Context
      type: object
      required:
        - loc
        - msg
        - type
      title: ValidationError

````