> ## Documentation Index
> Fetch the complete documentation index at: https://andcze.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# API overview

> Base URL, authentication, and API reference conventions.

The pages in this tab are generated from the [OpenAPI specification](https://github.com/andczey/itemshop-v2). Each endpoint has an interactive "Try it" form.

## Base URL

```text theme={null}
https://api.itemshop.dev/api/v2
```

Locally: `http://localhost:3000/api/v2`. All routes are prefixed with `/api/v2`.

## Authentication

An endpoint can require a `bearerAuth` session, a shop key through `apiKeyAuth`, accept either mechanism, or be public. For a key:

```http theme={null}
X-API-Key: <shop-key>
```

If an endpoint allows keys and both mechanisms are present, the key is checked. An ordinary Bearer route ignores the key and uses the session. Details: [Authentication](/en/guides/authentication).

## Response conventions

Success has the shape `{ success: true, data, message? }`; an error `{ success: false, statusCode, error, timestamp, path }`. Always check the `success` field. See [Error handling](/en/guides/errors).

## Identifiers

Resource identifiers (`shopId`, `serverId`, `orderId`, ...) are MongoDB ObjectIds — a 24-character hex string (`^[0-9a-fA-F]{24}$`). An invalid format returns `400`.

## Public endpoints

Some endpoints require no authentication: order creation, public catalogs, voucher redemption, discount-code validation, and payment webhooks. In the API reference they are marked as having no security.