API reference
Endpoints, payload shapes, and the payment and shipping integrations.
The backend is Medusa v2.19, so the bulk of the API is Medusa's own — documented upstream at docs.medusajs.com. This reference covers what is specific to AUTOXSPARE: the routes added, the two providers written for Malaysia, and the environment they read.
Storefront routes
Route handlers in the Next.js app: search suggestions, the Curlec return, OAuth callbacks.
Admin API
Custom endpoints added under /admin.
Curlec
The payment provider: amounts, signatures, the FPX redirect.
EasyParcel
The fulfillment provider, and what is still needed to switch it on.
Environment
Every variable the backend and storefront read.
Base URLs
| Environment | URL |
|---|---|
| Backend API | https://api.autoxspare.com |
| Admin panel | https://api.autoxspare.com/app |
| Storefront | https://new.autoxspare.com |
Authentication
Admin requests use a bearer token, not a cookie:
POST /auth/user/emailpass
Content-Type: application/json
{ "email": "you@example.com", "password": "..." }Returns { "token": "<jwt>" }. Send it as Authorization: Bearer <jwt> on
subsequent /admin/* requests.
GET /auth/user/providers lists the providers actually registered. Only
emailpass is live; Google, Apple and Facebook are wired in medusa-config.ts
but stay unregistered until their credentials are set.
Storefront requests use the publishable key header
(x-publishable-api-key) as usual for Medusa.