Quick start
Quick start
For an enterprise production integration, complete every gate in the enterprise integration journey, from readiness through production and incident response. This page covers only the first public read.
Choose the integration boundary
| Goal | Use | Never use |
|---|---|---|
| Read public catalog | Public Storefront API | Merchant session cookie |
| Access a user's account (after review/opening) | Authorization Code with PKCE S256 on the official authorization domain | Password grant, imitated sign-in, or shared Ayalink Cookie |
| Server-to-server app | Installation token with minimum scopes | Browser-held client secret |
| Receive business events | Installation-scoped signed Webhook | Unsigned callback or query token |
Create the developer organization, app version, and store installation in the Ayalink Merchant developer workspace. Production access is not implied by the documentation: the app version, requested scopes, legal consent, store capability, market, and installation must all be active.
Configure the public base URL
The Nuxt example requires only public configuration:
NUXT_PUBLIC_AYALINK_API_BASE=https://api.example.invalid/api/v1
NUXT_PUBLIC_AYALINK_AUTH_BASE=https://storefront.example.invalid
NUXT_PUBLIC_AYALINK_CLIENT_ID=replace-with-public-client-id
NUXT_PUBLIC_AYALINK_REDIRECT_URI=https://shop.example.invalid/oauth/callback
The values above are inert placeholders, not production endpoints. Never prefix a secret with NUXT_PUBLIC_.
Request public data
const response = await fetch(`${apiBase}/catalog/products`, {
headers: {
accept: 'application/json',
'accept-language': 'en',
'x-ayalink-market': 'US'
}
})
if (!response.ok) throw new Error(`AYALINK_HTTP_${response.status}`)
const envelope = await response.json()
Do not invent products when the API is unavailable. Treat 401, 403, 404, 409, 422, and 429 as distinct states described in errors and rate limits.