The Storefront API lets you create and manage customer accounts programmatically without needing to log in to Storefront Manager. This is useful if you have your own platform or control panel and want to automate customer provisioning when users sign up, sync customer records, or build tooling for your support team.
Customer object reference
A customer object returned by the API includes the following fields:
| Field | Type | Description |
|---|---|---|
id | UUID | Customer's unique ID |
first_name | string or null | First name |
last_name | string or null | Last name |
email | string | Email address |
username | string | Login username |
status | string | Account status (active, suspended, etc.) |
created_date | datetime or null | ISO 8601 timestamp of account creation |
last_login_date | datetime or null | ISO 8601 timestamp of last login |
phone | string or null | Phone number in normalized format |
address1 | string or null | Street address |
address2 | string or null | Address line 2 |
address3 | string or null | Address line 3 |
city | string or null | City |
state | string or null | State or province |
postal_code | string or null | Postal or ZIP code |
country | string or null | 2-letter ISO country code |
currency | object or null | {"code": "USD", "symbol": "$", "descr": "US Dollar"} |
totp_enabled | boolean | Whether 2FA is enabled on the account |
external_user_id | string or null | Your internal reference ID |
stripe_customer_id | string or null | Stripe customer ID if a payment method is on file |
Single sign-on (SSO) login
The SSO endpoint generates a short-lived, single-use URL that logs a specific customer into Storefront without requiring their username and password. Use this to redirect a customer who's already authenticated on your own platform directly into their Storefront account — for example, from a "Manage Domains" button in your own portal.
Behavior:
- The URL expires 15 minutes after it's generated and can only be used once.
- The URL is invalidated the moment it's used, whether or not the login succeeds.
- Token login bypasses any multi-factor authentication configured on the customer's account.
- Every customer login completed through the API — including SSO logins — is recorded in your Storefront event log, so you can track how often it's used.