# Show HN: Agent First Shopify Competitor? > Source: > Published: 2026-09-11 13:57:51+00:00 ## Start here ## API 571 operations across catalogue, orders, customers, pricing, and money. Call it from any platform that can send an HTTP request. ## MCP Point an AI client, Claude Desktop, an IDE, another agent, at one endpoint and it can read and write your live storefront. ## CLI Pull your storefront to disk, edit it in your own editor with live preview, and publish when you’re ready. REST API base URL for every request: `https://api.mercemur.com/api/v1` · MCP endpoint: `https://mcp.mercemur.com/mcp` ## The REST API in detail ## Quickstart Create a key and make your first call in under five minutes. ## API reference Every endpoint, with a playground you can fire against your own store. ## Rate limits Understand throttling and how to back off correctly. ## Authentication and security ## API keys Secret keys, how to create them, and how to rotate one safely. ## Scopes Read, write and delete are separate grants. 136 scopes across 66 families. ## Error handling One envelope for every refusal, at every status. ## Making requests ## Idempotency Every write takes an `Idempotency-Key`. Retry safely. ## Pagination Cursor paging, forward only, signed and bound to the route that issued it. ## Money Every amount is an integer in the currency’s minor unit. ## The four things that are not guessable from one endpoint If you read nothing else, read these. They are the conventions that a single example request will not teach you, and each one has bitten an integration. ## Money is an integer in minor units, never a decimal `1999` in a `usd` field is 19.99 USD. There are no fractional amounts anywhere in this API, and no field accepts a decimal. Currencies with no minor unit, such as JPY, take the whole number directly. See [Money](/requests/money). ## Read and write are separate grants Read and write are separate grants `write_products` does **not** let a key read your catalogue, and deleting is a third grant again: `write_products:delete`. A key that keeps records up to date cannot destroy them unless you tick Delete as well. See [Scopes](/authentication/scopes). ## Every write requires an Idempotency-Key Every write requires an Idempotency-Key Not optional, and not only for retries. A request without the header is refused with `idempotency_key_required`. Replaying the same key returns the stored response rather than executing twice. See [Idempotency](/requests/idempotency). ## Paging is by cursor, forward only Paging is by cursor, forward only There is no `page` or `offset` parameter. You send `?after=` with the `page.next_cursor` from the previous response **for that same endpoint**. A cursor from a different collection is refused. See[Pagination](/requests/pagination). ## Branch on `code`, never on `message` Every refusal on this API, at every status, has the same body: `code` is the contract and is safe to switch on. The `message` is English prose for a human reading a log, and its wording is not part of this contract. See [Error envelope](/errors/envelope).