Authentication and project routing
Every GraphQL request targets one Thor project. Authentication then determines whether the caller may use the selected API and, for Storefront requests, whether a customer identity is present.
Endpoints
Replace {project} with the project slug supplied for the environment. The API landings also document the supported header-based project routing form. Keep the slug, endpoint, and credentials from the same environment.
Admin API
The Admin API accepts an Admin user bearer token or an API key through the documented Admin header. API keys belong only in trusted server code, secret stores, and deployment configuration. Some user-attributed operations, including the documented import/export jobs, require a bearer token with human Admin claims rather than an API key.
Storefront API
A public project can allow anonymous Storefront requests. A protected project requires x-thor-storefront-token. This token authorizes access to the project’s Storefront surface; it is not a signed-in customer.
After customer sign-in, send the customer access token as Authorization: Bearer <token>. Customer identity can affect protected customer reads and customer-group commerce context. It does not grant Admin API access and does not replace a required storefront token.
Credential boundaries
Browser and mobile applications may use only Storefront credentials intended for that environment. Proxy Admin operations through a trusted service. Never put an Admin API key in client bundles, URLs, logs, or examples intended to run in a browser.