Connect to a project
Thor exposes one Admin GraphQL endpoint and one Storefront GraphQL endpoint per project. Use the project slug and credentials supplied for the same environment; this guide does not assume a self-service provisioning flow.
Endpoints and credentials
Admin requests use either Authorization: Bearer <admin-token> or the API-key header documented on the Admin API landing. Storefront requests to protected projects use x-thor-storefront-token. A customer bearer token identifies a signed-in buyer and is separate from project access.
Keep Admin API keys and Admin user tokens in trusted server code. Never ship them in a browser or mobile bundle. Storefront credentials may be used only according to the access model configured for that project.
Minimal Admin check
A connected project returns a GraphQL JSON object with data.stores. An empty nodes list is still connectivity success. A non-JSON response, HTTP authorization failure, or top-level GraphQL errors requires checking the endpoint, slug, credential type, and permission.
For a protected Storefront project, use the same request shape against the Storefront endpoint with x-thor-storefront-token and a minimal products(first: 1) query. Catalog results can be empty because context or publication is incomplete; connectivity and catalog visibility are separate checks.