Authentication

The Marketplace Engine API uses Laravel Passport OAuth2-style access tokens for customers, vendors, and delivery drivers. Issue a token via the relevant login endpoint, then send it on protected routes.

Base path

{marketplace-host}/api/v3/

Customer

• POST /auth/sign-up — register
• POST /auth/login — email/phone login → Bearer token
• POST /auth/social-login / POST /auth/social-register
• POST /auth/forgot-password, POST /auth/verify-token, PUT /auth/reset-password
• POST /auth/verify-phone, email check/verify helpers

POST /api/v3/auth/login
Content-Type: application/json

{ "email_or_phone": "…", "password": "…" }

Successful login returns an access token. Use it as:

Authorization: Bearer {access_token}

Guest sessions

Unauthenticated storefront users can still use cart and place/track flows via POST /auth/guest/request. Guest-capable customer routes sit behind the apiGuestCheck middleware (cart, order place/track, etc.).

Vendor

• POST /vendor/auth/login
• POST /vendor/auth/register
• Password reset under /vendor/auth/*

Authenticated vendor API routes use the vendor.api middleware group under /vendor/*.

Delivery driver

• POST /auth/driver/login
• POST /auth/driver/store — joining / registration
• Password reset under /auth/driver/*

Authenticated driver routes live under /driver/* with the driver.api middleware.

Common request headers

• Authorization: Bearer {token} — when authenticated
• zoneId — JSON array string of zone IDs, e.g. [3]
• X-localization — locale code (en, tr, …)
• Content-Type: application/json

Admin support surfaces

Selected /admin/* JSON routes (support tickets, knowledge centre, dashboard stats, promoted restaurants, shop admin, etc.) are gated by a configured support key header: X-Web-Admin-Support-Key. This is for licensed ops tooling — not a public third-party key.

EPOS & supplies shop

• POST /epos/login — in-restaurant EPOS session
• POST /shop/auth/login — supplies shop vendor login