Account

Your account has a username and nothing else: no e-mail, no name. Carts, orders and products you create are visible only to you.

Send this token in the Authorization header to call the API from Postman, curl or Swagger as yourself. It is valid for 8 hours; sign in again for a new one.

Header: Authorization: Bearer <token>. Anyone with the token can act as you until it expires – do not post it in public.

Connect DBeaver or psql to see what the shop saved. This login can read the catalog and your own rows, and nothing else. It cannot change anything.

Use an SSL connection. The password belongs to you: do not post it in public.

Start a task from a clean state: this deletes your cart, orders, payment attempts and the products you created through the API. Your account and sign-in stay.