---
title: "Developers, Mercemur"
description: "Build on Mercemur with the Admin and Store APIs, webhooks, the CLI, and MCP. Typed REST, tenant-isolated data, and no proprietary framework to learn."
canonical_url: "https://mercemur.com/developers"
last_updated: "2026-09-15"
---

Developers

# Build commerce that bends to you

Admin and Store APIs, signed webhooks, a CLI, and an MCP server. One commerce core, reachable however you build.

1.  [Home](https://mercemur.com/)
3.  Developers

On this page

1.  [Get a key, call the API, ship](https://mercemur.com/developers#quick-start)
2.  [Developer surfaces](https://mercemur.com/developers#surfaces)
3.  [Generate a typed client](https://mercemur.com/developers#typed-clients)
4.  [Documentation and examples](https://mercemur.com/developers#resources)

Get started in minutes

## Get a key, call the API, ship.

There is no framework to adopt and no runtime of ours in your stack. Authenticate with a scoped key, call REST endpoints from whatever you already write, and deploy on your own schedule.

[Create a free account](https://mercemur.com/contact) [Jump into API reference →](https://docs.mercemur.com/api-reference/introduction)

The full contract is an OpenAPI 3.1 document generated from the routes the server actually serves: [openapi.yaml](https://docs.mercemur.com/openapi.yaml).

terminal

```bash
# a scoped secret key from Settings -> API keys
export MERCEMUR_API_KEY=sk_...

# read the catalog
curl https://api.mercemur.com/api/v1/products \
  -H "Authorization: Bearer $MERCEMUR_API_KEY"

# receive events instead of polling for them
curl -X POST https://api.mercemur.com/api/v1/webhook-endpoints \
  -H "Authorization: Bearer $MERCEMUR_API_KEY" \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: $(uuidgen)" \
  -d '{"url":"https://example.com/hooks","subscribed_events":["orders/paid"]}'
```

Developer surfaces

## Everything you need to build on top of a real commerce core.

### Admin API

The same REST API the Mercemur dashboard runs on. Catalog, orders, customers, fulfilment, pricing, and settings, all scoped to one store by the key you use.

-   Bearer auth with secret API keys; publishable keys cannot reach it
-   Scoped keys, so a reconciliation job never gets write access it does not need
-   Tenant isolation enforced in Postgres row-level security, not just app code
-   Cursor pagination, idempotency keys, and typed error envelopes throughout

[Read the API reference →](https://docs.mercemur.com/api-reference/introduction)

### Store API

The customer-facing half: catalog reads, cart, checkout, and accounts. Build a storefront in any framework, or a mobile app, against the same contract the default storefront uses.

-   Everything a storefront needs without touching back-office endpoints
-   Money always in integer minor units, so no float rounding reaches a total
-   Multi-currency and multi-region aware, including tax and shipping rules
-   Works from any stack; nothing here assumes JavaScript

[Browse the endpoints →](https://docs.mercemur.com/api-reference/introduction)

### Webhooks and events

Subscribe to domain events instead of polling. HMAC-signed delivery with retries, and a delivery log you can inspect and replay when a handler was down.

-   Register endpoints through the API and pick the events each one receives
-   HMAC signatures with a timestamp window, so a replayed body is rejected
-   Delivery history is queryable, so you can see exactly what was sent and when
-   Redelivery is idempotent, so a retry cannot double-apply an order

[Set up webhooks →](https://docs.mercemur.com/cli/webhooks)

### Mercemur CLI

Drive a store from your terminal and keep theme work in version control. Local theme development, webhook tunnelling, catalog edits, and typed client generation.

-   \`theme dev\`, \`theme check\`, and \`theme publish\` for storefront work with history
-   \`webhook listen\` forwards live events to localhost while you build the handler
-   Bulk catalog, media, metafields, translations, redirects, and SEO operations
-   \`types\` generates typed clients so the API contract is checked at compile time

[CLI reference →](https://docs.mercemur.com/cli/overview)

### MCP server

Mercemur speaks Model Context Protocol, so an AI assistant can run the store directly: read the catalog, draft products, restructure a storefront, and answer questions about sales.

-   OAuth-connected, scoped to one store, with the same permissions a key carries
-   Catalog, media, orders, and storefront layout tools, not just read-only lookups
-   Changes are previewed and published explicitly, so nothing goes live unreviewed
-   Works with any MCP client, including Claude

[Connect an assistant →](https://docs.mercemur.com/mcp/overview)

### Custom integrations

Integrations are ordinary API clients. There is no plugin format to learn, no registry to publish through, and nothing to keep compatible across upgrades.

-   Your service authenticates with a scoped key and calls the same public API
-   It runs on your infrastructure, in your language, on your deploy schedule
-   No proprietary runtime, so an upgrade on our side cannot break your code
-   ERP, accounting, marketplace, and fulfilment integrations all follow this shape

[Integration guides →](https://docs.mercemur.com/integrations/overview)

app/account/orders/page.tsx

```tsx
// Any runtime that can make an HTTPS request. No SDK required.
const res = await fetch(
  "https://api.mercemur.com/api/v1/orders?limit=10",
  { headers: { Authorization: `Bearer ${process.env.MERCEMUR_API_KEY}` } }
)

const { data, page } = await res.json()

// Totals are integer minor units, so they never lose a cent to a float.
for (const order of data) {
  console.log(order.id, order.total_minor, order.currency_code)
}

// page.next_cursor continues where this call stopped.
```

Types, not guesswork

## Generate a typed client for the language you already use.

`mercemur types` emits a client from the same OpenAPI document the backend enforces, so request shapes, response fields, and error codes match what the server actually does. You get compile-time checking without taking a dependency you have to keep in step with our release schedule.

-   The spec is published, so any generator you prefer works too
-   Regenerate on upgrade and let the compiler find what moved
-   Typed error envelopes, so failure cases are handled explicitly
-   No runtime of ours in your dependency tree

Resources

## Documentation, examples, and a community to help you ship.

[API reference →](https://docs.mercemur.com/api-reference/introduction)

Every endpoint, every field, every status code. Generated from the same OpenAPI spec the backend enforces.

[CLI reference →](https://docs.mercemur.com/cli/overview)

Theme development with history, webhook forwarding to localhost, and bulk catalog work from the terminal.

[MCP server →](https://docs.mercemur.com/mcp/overview)

Connect an AI assistant to a store over Model Context Protocol, scoped to the permissions its key carries.

## Sitemap

- [Site index (llms.txt)](https://mercemur.com/llms.txt): every public page, described
- [Sitemap (sitemap.md)](https://mercemur.com/sitemap.md): every public URL with its last-modified date
- [AGENTS.md](https://mercemur.com/AGENTS.md): how to build against the platform
- [Developer documentation](https://docs.mercemur.com/llms.txt): API reference, CLI, MCP