Storefront token
Get a short-lived token for Bigblue modules that run in the browser.
POST
/Returns a short-lived token for the shop linked to your API key's integration. Bigblue storefront modules, such as the pickup point picker, use it to call Bigblue from the customer's browser.
The request has no fields. You can send {} or an empty body.
Keep your API key on the server
Never send your API key to the browser. Get the token on your server and pass the token to the page.
Responses
tokenstringThe storefront token. Safe to use in the browser.
expiry_timestringWhen the token expires, RFC 3339 UTC. Get a new one before then.
{ "code": "not_found", "msg": "no storefront for this store" }Set up storefront access for the shop in the Bigblue app first.
POST
/curl -X POST https://api.bigblue.co/bigblue.storeapi.v1.PublicAPI/GetStorefrontAccessToken \
-H "Authorization: Bearer $BIGBLUE_API_KEY" \
-H "Content-Type: application/json"{
"token": "sft_9f8e7d6c5b4a3f2e1d0c9b8a7f6e5d4c",
"expiry_time": "2026-03-14T10:30:00Z"
}let cached: { token: string; expiresAt: number } | null = null;
export async function storefrontToken() {
if (cached && cached.expiresAt - Date.now() > 60_000) return cached.token;
const res = await call('GetStorefrontAccessToken', {});
cached = { token: res.token, expiresAt: new Date(res.expiry_time).getTime() };
return cached.token;
}Reuse the token until a minute before it expires. Requesting a new one for every page view uses up your rate limit.