Authentication

Authentication Overview

ThreeU uses token-based authentication across all APIs. Every API request must include a valid token in the Authorization header. Different contexts require different token types, each with specific security requirements and permission scopes.

Bearer Token Authentication

All authenticated API requests use the Bearer token scheme:

curl -X GET https://api.threeu.app/api/plugins/installed \
  -H "Authorization: Bearer YOUR_TOKEN_HERE" \
  -H "platform-id: my-store" \
  -H "Content-Type: application/json"

Developer Authentication

Developers authenticate through a dedicated flow:

1. Apply — Submit a developer application through ThreeU
2. Approval — ThreeU reviews and provisions a developer account with status pending
3. Invite — An invitation email is sent to the developer
4. Accept — Developer calls POST /developer/accept-invite to activate
5. Login — POST /developer/login returns a bearer token
6. Bootstrap — GET /developer/me loads the profile

// Accept invite
const response = await fetch('https://api.threeu.app/api/developer/accept-invite', {
  method: 'POST',
  headers: { 'Content-Type': 'application/json' },
  body: JSON.stringify({
    email: '[email protected]',
    password: 'secure_password',
    password_confirmation: 'secure_password'
  })
});

// Login
const loginRes = await fetch('https://api.threeu.app/api/developer/login', {
  method: 'POST',
  headers: { 'Content-Type': 'application/json' },
  body: JSON.stringify({ email: '[email protected]', password: 'secure_password' })
});
const { token } = await loginRes.json();

Token Safety Rules

Different tokens have different security requirements: