REST API

Authentication#

All dashboard routes require authentication via Auth.js (JWT strategy) with Google OAuth. Storefront and webhook routes are public.

# Auth is handled via session cookies after Google OAuth login.
# No API key needed for dashboard routes — session-based auth.

# For CLI and MCP, use API keys:
Authorization: Bearer op_live_your_key_here

Stripe Webhooks#

Receives Stripe webhook events. Authenticates via Stripe-signed payload. Idempotent.

• checkout.session.completed — Marks order as paid
• account.updated — Updates expert Stripe onboarding status

Communications#

List available email templates. Auth required.

Enqueue an email for sending. Auth required.

{
  "orderId": "uuid",
  "templateId": "deliverable_ready",
  "variables": {
    "customerName": "Jane",
    "expertName": "Dr. Smith",
    "productName": "Market Analysis"
  },
  "recipientEmail": "jane@example.com"
}

Template IDs: order_confirmation, in_progress, deliverable_ready, review_requested, completed

Rate Limits#

Error Responses#

All errors follow a consistent format:

{
  "error": "Unauthorized",
  "message": "Valid session required"
}