Tokens

A token is how a page on your website reads from Organization Depot. You make one in Organization Depot and put it in your page or in your site's settings.

Today, tokens belong to a storefront. You make them on your shop's Storefront › Your own website page (titled Headless), under Tokens, and they come in two kinds:

Public tokens

A public token (odpk_ and 32 letters and digits) names one storefront: one shop's public face. It's the only thing the script needs. No shop id, domain or account goes with it.

• It's meant to be public. It sits in your page's source, where anyone can read it. That's safe because of what it can do: read your catalog and build carts, nothing else. It can't see orders, buyers or payments, and it can't change products, prices or settings.
• It isn't tied to your domain. There is no list of allowed websites: any page could use a copied token, and all it would get is your public catalog and carts of its own. Rate limits per buyer keep it from being abused.
• It travels in a header, X-OD-Storefront-Token, never in a URL. URLs end up in logs and analytics. The script does this for you.
• One token per purpose. A shop can have up to 10 active tokens, public and preview together, each with a label ("Main website", "Staging") and the time it was last used, so you can tell what's still in use.
• Revoking a token on the Headless page stops it within 60 seconds: requests with it get 401 TOKEN_INVALID.

Note: the buyer's stored cart is kept per token. Replacing a site's token (create a new one, deploy it, then revoke the old one) starts returning buyers on a new, empty cart.

Preview tokens

A preview token (odpv_ and 32 letters and digits) is for building your site. It reads the same catalog as a public token, and the carts it makes are preview carts:

• They work while the shop is closed. A draft shop, a paused one, or one outside its sale window still lets a preview token create carts, so you can build and test before the sale opens or while it's paused to keep buyers out. A public token gets 409 SALE_CLOSED then.
• They pay only in test mode. A preview cart goes all the way through the hosted checkout, which shows the real tax, fees and total and takes payment with Stripe's test cards: 4242 4242 4242 4242 succeeds, 4000 0027 6000 3184 shows 3-D Secure, 4000 0000 0000 0002 is declined. No order is placed, no stock is taken and no money moves, and real cards don't work. Then the cart is finished, so your site starts a new one. That holds while the shop is open too, so you can work against a live shop without any chance of taking a real order.
• shop.preview is true when the client uses a preview token. shop.sale still reports the real sale, so enable Add to cart when shop.sale.availableForSale || shop.preview: buyers on your live site wait for the sale, and you can add while the shop is closed. The web components and the starters do exactly this.
• cart.preview is true on every cart a preview token makes, and the web components' cart says so ("Preview cart: checkout takes test cards only").
• A cart belongs to its kind of token. A public token can't read a preview cart, and a preview token can't read a real one: either answers 404 NOT_FOUND.
• Keep it in your local settings, never on your live site: buyers there would fill test-mode carts that take no real card. See Local development and Security.

Everything else (the header, the 10-token limit, revoking) works as for public tokens.