Your first StoreOS API request
Make the first StoreOS API call and confirm the tenant UID, the storefront API host, and that the catalog response belongs to your store.
What you're testing
A successful first request proves:
- Your tenant UID is correct (
x-tenant) - Your app can reach storefront-api.storeos.dev
- StoreOS returns your catalog data
Start with catalog (products) or store config (tenant). Both work without a logged-in customer.
Option A — TypeScript SDK (recommended)
What happens: getProducts calls GET /api/v1/products with your tenant header and returns typed product data.
import { StoreFront } from "@storeos/storefront-client";
const store = new StoreFront({
tenant: "your-tenant-uid",
});
const { nodes: products, meta } = await store.getProducts({ limit: 12 });
const tenant = await store.getTenant();
console.log(tenant.name, "—", meta.totalCount, "products");In your app, use env vars instead of hardcoded values → Configuration.
Option B — REST with fetch
What happens: Your app sends HTTP directly to the same endpoints the SDK uses.
const res = await fetch(
"https://storefront-api.storeos.dev/api/v1/products?limit=12",
{ headers: { "x-tenant": "your-tenant-uid" } },
);
const { nodes, meta } = await res.json();Store config:
curl https://storefront-api.storeos.dev/api/v1/tenant \
-H "x-tenant: your-tenant-uid"Explore every route in Swagger.
Option C — GraphQL
What happens: One POST to /graphql with a query body. Same data as REST, different shape.
const res = await fetch("https://storefront-api.storeos.dev/graphql", {
method: "POST",
headers: {
"Content-Type": "application/json",
"x-tenant": "your-tenant-uid",
},
body: JSON.stringify({
query: `
query {
products(input: { limit: 12 }) {
nodes { _id title handle price }
meta { totalCount }
}
}
`,
}),
});
const { data } = await res.json();Logged-in requests
What changes: Customer JWT in the Authorization header. Required for order history, profile, and cancel.
Authorization: Bearer <access-token>The SDK sets this automatically after login, register, or verifyOtp.
→ Auth · SDK methods