Retrieve the current store
“Whoami” for an API key: the store the key belongs to and the scopes it was granted. Any valid key may call this, whatever it was granted — scopes is the calling key’s own, so an integration can check what it may do without provoking a 403 to find out.
storefrontUrl is the canonical public origin (an active custom domain wins over the slug subdomain), and null while the storefront is unclaimed or switched off.
Authorizations
A store API key, sent as Authorization: Bearer <key>.
A key looks like tbrn_live_ followed by 48 hex characters, e.g. tbrn_live_4f2a...c91b. Mint one in the Taberna dashboard under Developers → API Keys, tick the scopes the integration needs, and copy it there and then — the full value is shown once and only its hash is stored, so a lost key is replaced rather than recovered.
One key belongs to one store and carries a fixed scope set. Send it from a server, never from a browser: it can create orders and invoices and read every order the store has.
Response
The store behind the API key.
The store behind the calling API key, and what that key may do.
The store's id. Formatted as a UUID, e.g. 3f1a9c2e-7b04-4d8e-9a6f-2c5b1e0d7a83.
"3f1a9c2e-7b04-4d8e-9a6f-2c5b1e0d7a83"
Store name, as shown to buyers.
"Acme Digital"
Absolute URL of the store logo, or null when it has none.
"https://cdn.taberna.io/stores/acme.png"
Tokens this store accepts; a checkout may only start an attempt on one of these. The token and chain the buyer pays with, named <asset>_<chain>; a bare sol, eth, matic or bnb is that chain's native coin. So usdc_base is USDC on Base and eth is ether on Ethereum mainnet. The matic key is Polygon's native coin, now called POL — the key keeps its original name and does not change.
sol, usdc_solana, eth_base, usdc_base, usdt_base, eth, usdc_ethereum, usdt_ethereum, matic, usdc_polygon, usdt_polygon, bnb, usdt_bnb Whether the hosted checkout makes the buyer enter an email before paying.
true
When the store was created. UTC timestamp in ISO 8601, e.g. 2026-07-29T14:30:00.000Z.
"2026-07-29T14:30:00.000Z"
The store's storefront handle, used as the subdomain. Null while the storefront is unclaimed.
"acme"
Whether the public storefront is switched on.
true
The scopes granted to the API key making this call — not everything the store could grant. Permissions on a store API key. Each :read scope allows the matching list/retrieve routes and each :write the mutating ones; webhooks:write covers resending a delivery only, never repointing where events are sent.
orders:read, orders:write, invoices:read, invoices:write, products:read, products:write, webhooks:read, webhooks:write The canonical public storefront origin; an active custom domain wins over the slug subdomain. Null while the storefront is unclaimed or switched off, because the host would not resolve.
"https://acme.taberna.io"