generated: '2026-08-12'
method: searched
source: https://docs.mikmak.ai/reference/commerce-api-authentication
docs:
  - https://docs.mikmak.ai/reference/commerce-api-authentication
  - https://docs.mikmak.ai/reference/authorization-code-flow
  - https://docs.mikmak.ai/docs/authentication-1
  - https://docs.mikmak.ai/docs/mikmak-platform-auth0-enterprise-sso-integration-guide
derived_from:
  - openapi/mikmak-commerce-api-openapi.yml
  - openapi/mikmak-insights-api-openapi.yml
provider: MikMak
providerId: mikmak
summary:
  types:
    - apiKey
    - http
    - oauth2
  api_key_in:
    - header
  oauth_grants:
    - client_credentials
    - authorization_code
    - refresh_token
  credential_issuance: manual
  note: >-
    Credentials are not self-service. MikMak provisions the API key, and one OAuth client
    (client_id + client_secret) per integrator, during onboarding; there is no public developer
    signup that issues keys.
schemes:
  - name: ApiKeyAuth
    type: apiKey
    in: header
    parameter: x-api-key
    description: >-
      MikMak commerce API key, issued during onboarding. Server-side use only; the docs
      explicitly warn against exposing it in frontend, mobile or client-side JavaScript.
    applies_to:
      - MikMak Headless Commerce API
      - MikMak Insights API
      - MikMak Commerce MCP Server
    sources:
      - openapi/mikmak-commerce-api-openapi.yml
      - openapi/mikmak-insights-api-openapi.yml
      - https://docs.mikmak.ai/reference/commerce-api-authentication
  - name: JWTBearerAuth
    type: http
    scheme: bearer
    bearerFormat: JWT
    description: >-
      OAuth 2.0 bearer token presented as `Authorization: Bearer <token>`. Required (not
      optional) on the hosted MCP endpoint; an alternative to the API key on the Commerce API.
    applies_to:
      - MikMak Headless Commerce API
      - MikMak Insights API
      - MikMak Commerce MCP Server
    sources:
      - openapi/mikmak-commerce-api-openapi.yml
      - openapi/mikmak-insights-api-openapi.yml
      - https://docs.mikmak.ai/docs/authentication-1
  - name: OAuth2ClientCredentials
    type: oauth2
    flow: clientCredentials
    tokenUrl: https://api.mikmak.ai/commerce/v1/oauth/token
    description: >-
      Machine-to-machine grant. POST a JSON body of grant_type=client_credentials, client_id and
      client_secret. Returns access_token, token_type Bearer and expires_in. Token lifetime is
      configured per application by MikMak, between 24 hours and 30 days. No refresh token is
      issued for this grant.
    scopes: {}
    sources:
      - https://docs.mikmak.ai/reference/commerce-api-authentication
  - name: OAuth2AuthorizationCode
    type: oauth2
    flow: authorizationCode
    authorizationUrl: https://api.mikmak.ai/commerce/v1/authorize
    tokenUrl: https://api.mikmak.ai/commerce/v1/oauth/token
    refreshUrl: https://api.mikmak.ai/commerce/v1/oauth/token
    description: >-
      User-delegated grant for applications acting on behalf of a logged-in MikMak user
      (partner dashboards, third-party integrations). redirect_uri must be pre-registered with
      MikMak. `state` is documented as REQUIRED and must be verified on callback. The
      authorization code is single-use. Token responses carry expires_in 2592000 (30 days) and
      a rotating refresh_token — each refresh invalidates the previous refresh token.
    scopes:
      offline_access: Issue a refresh token so the application can renew access without user re-consent.
    pkce: not-documented
    sources:
      - https://docs.mikmak.ai/reference/authorization-code-flow
  - name: MCPHostedJWT
    type: oauth2
    flow: clientCredentials
    description: >-
      The hosted MCP server at https://mcp.mikmak.ai/commerce/v1 validates an Auth0-issued JWT.
      MikMak supplies the token URL, client_id, client_secret and a per-environment `audience`
      that must be pinned in the token request; a well-formed token minted for the wrong
      audience is rejected with 401 AUTH_UNAUTHORIZED. Neither the token URL nor the audience
      is published — both are handed over at onboarding.
    scopes: {}
    token_lifetime_seconds: 86400
    sources:
      - https://docs.mikmak.ai/docs/authentication-1
      - https://docs.mikmak.ai/docs/hosted-integration
identity_headers:
  - header: x-api-key
    purpose: MikMak commerce API key. Overrides any server-side configured value.
  - header: x-wtb-id
    purpose: WTB (experience) identifier scoping the request to one MikMak experience.
  - header: X-Request-Id
    purpose: Optional client-supplied trace id, echoed in MikMak server logs for support correlation.
resolution_order:
  order:
    - value passed on the MCP tool call (wtb_id / api_key arguments)
    - HTTP request header (x-wtb-id / x-api-key)
    - server-side configuration on the MCP deployment
  note: First non-empty value wins; a still-missing value returns a configuration error.
end_user_sso:
  provider: Auth0
  protocols:
    - SAML
    - OIDC
  description: >-
    Enterprise SSO into the MikMak platform (not the API) is brokered through Auth0 against the
    customer's own IdP.
  source: https://docs.mikmak.ai/docs/mikmak-platform-auth0-enterprise-sso-integration-guide
transport:
  https_required: true
  notes:
    - Tokens and keys must never be sent over non-HTTPS connections.
    - client_secret must be held in a secret manager and never shipped to a browser.
    - Rotation of client_secret is requested from MikMak, not self-service.
maintainers:
  - FN: Kin Lane
    email: kin@apievangelist.com