Authentication

Log in

POST /auth/login

Exchange an email and password for a bearer token. Use the token for every subsequent request to Get stock:

Authorization: Bearer <token>

Request body

Field	Type	Notes
email	string	required
password	string	required

curl -X POST 'https://api.wms.restock.tech/auth/login' \
  -H 'Content-Type: application/json' \
  -d '{"email":"client@example.com","password":"••••••••"}'

Response

{
  "success": true,
  "data": {
    "users": { "id": "...", "email": "client@example.com" },
    "token": "eyJhbGciOi...",
    "modules": [ /* module + permission tree for this user */ ]
  },
  "message": null,
  "code": 200
}

401 on wrong credentials. 403 if the account has been blocked.

Access keys (order channel)

The order endpoints live on a separate integration channel — different credentials, different base path (/api/web/*). They do not use the bearer token. They use a dedicated x-access-key / x-secret-key pair that Restock provisions for your integration during onboarding — ask your Restock contact if you don’t have one yet.

Every request needs both headers:

x-access-key: <your access key>
x-secret-key: <your secret key>

The same secret key verifies webhook signatures.