const options = {
  method: 'POST',
  headers: {'Content-Type': 'application/json'},
  body: JSON.stringify({email: 'seller@example.com', password: 'password123', provider: 'email'})
};

fetch('http://{defaultHost}/api/v3/seller/auth/login', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

curl --request POST \
  --url http://{defaultHost}/api/v3/seller/auth/login \
  --header 'Content-Type: application/json' \
  --data '
{
  "email": "seller@example.com",
  "password": "password123",
  "provider": "email"
}
'

{
  "token": "eyJhbGciOiJIUzI1NiJ9.eyJ1c2VyX2lkIjoxLCJ1c2VyX3R5cGUiOiJhZG1pbiIsImp0aSI6IjE5NWY4OTE2LWI3NGQtNDg2MS1hMTQ3LTJmMDhiMzhiMWIzNSIsImlzcyI6InNwcmVlIiwiYXVkIjoic2VsbGVyX2FwaSIsImV4cCI6MTc2ODQ3ODcwMH0.e2XwsDONtD0x4j9jfjnHhDhAJpzhXBQ2LuIjWS1kY1k",
  "user": {
    "id": "adm_UkLWZg9DAJ",
    "email": "seller@example.com",
    "first_name": "Jan",
    "last_name": "Cummerata",
    "full_name": "Jan Cummerata",
    "created_at": "2026-01-15T12:00:00.000Z",
    "avatar_url": null
  },
  "sellers": [
    {
      "id": "sel_UkLWZg9DAJ",
      "name": "Seller 1",
      "status": "approved"
    }
  ]
}

{
  "error": {
    "code": "authentication_failed",
    "message": "Invalid email or password"
  }
}

Login

Signs a seller in and returns a short-lived JWT access token carrying the seller_api audience. The rotatable refresh token is set in an HttpOnly cookie — it is not included in the response body.

The response lists every seller this user may act for. Pick one and send its id as X-Spree-Seller-Id on every subsequent request; nothing else on this API answers until a seller is named.

Authenticating is not on its own enough. A store’s own staff share the same user class, so a user who runs no seller is refused — issuing a token would hand out an audience its holder can do nothing with.

The provider field selects the authentication method. When omitted it defaults to email. Sellers and store staff read different provider registries, so a marketplace can require SSO for its own back office while still letting sellers sign in with a password.

POST

api

seller

auth

const options = {
  method: 'POST',
  headers: {'Content-Type': 'application/json'},
  body: JSON.stringify({email: 'seller@example.com', password: 'password123', provider: 'email'})
};

fetch('http://{defaultHost}/api/v3/seller/auth/login', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

curl --request POST \
  --url http://{defaultHost}/api/v3/seller/auth/login \
  --header 'Content-Type: application/json' \
  --data '
{
  "email": "seller@example.com",
  "password": "password123",
  "provider": "email"
}
'

{
  "token": "eyJhbGciOiJIUzI1NiJ9.eyJ1c2VyX2lkIjoxLCJ1c2VyX3R5cGUiOiJhZG1pbiIsImp0aSI6IjE5NWY4OTE2LWI3NGQtNDg2MS1hMTQ3LTJmMDhiMzhiMWIzNSIsImlzcyI6InNwcmVlIiwiYXVkIjoic2VsbGVyX2FwaSIsImV4cCI6MTc2ODQ3ODcwMH0.e2XwsDONtD0x4j9jfjnHhDhAJpzhXBQ2LuIjWS1kY1k",
  "user": {
    "id": "adm_UkLWZg9DAJ",
    "email": "seller@example.com",
    "first_name": "Jan",
    "last_name": "Cummerata",
    "full_name": "Jan Cummerata",
    "created_at": "2026-01-15T12:00:00.000Z",
    "avatar_url": null
  },
  "sellers": [
    {
      "id": "sel_UkLWZg9DAJ",
      "name": "Seller 1",
      "status": "approved"
    }
  ]
}

{
  "error": {
    "code": "authentication_failed",
    "message": "Invalid email or password"
  }
}

Body

application/json

string<email>

required

Example:

"seller@example.com"

password

string

required

Example:

"password123"

provider

enum<string>

default:email

Available options:

email

Response

token

string

required

JWT access token, seller_api audience

user

object

required

Show child attributes

sellers

object[]

required

The sellers this user may act for. Pick one and send its id as X-Spree-Seller-Id on every subsequent request.

Show child attributes

⌘I

API basics

Endpoints

Login

Body

Response