Production platformSQLite-only commerce
API status

Guide 02 · Shop operations

Automate operator work without exposing a reusable secret.

Provision a scope-limited credential through an authenticated browser session, encrypt it for the local Windows user, and require an audit reason for every account mutation.

Open operator consoleCheck API readiness

Secure provisioning

Create and protect an automation credential

  1. Authenticate in the operator console

    Request a passwordless link for an allowlisted operator email. The browser session is short-lived, HTTP-only, and CSRF protected.

  2. Create a CLI credential

    Use Create CLI credential in the authenticated console. Copy the raw value immediately; it is displayed once and only its SHA-256 hash is retained by the server.

  3. Encrypt it locally

    From the AI Model Builder project root, run the protection command and paste the credential only into its hidden prompt.

    npm run operator:protect

  4. Remove temporary copies

    Clear the clipboard and close any terminal buffer that could retain the raw one-time value.

Audited operations

Use the account commands

Upgrade an account

npm run operator:account -- --email customer@example.com --action upgrade --plan enterprise --reason "Approved Enterprise access"

Review accounts

npm run operator:accounts -- --search customer@example.com

Synchronize database pricing to Stripe

npm run operator:sync-stripe -- --reason "Publish approved catalog pricing"

Use the operator console for validation, blocking, unblocking, removal, token revocation, and product editing when visual review is safer than automation.

Built-in safeguards

What protects these operations

One-time display

The raw credential is returned only at creation and is never recoverable from SQLite.

Local encryption

Windows DPAPI binds the protected value to the current operating-system user.

Limited scope

Automation access cannot mint new automation credentials.

Audit reasons

Account and catalog mutations require a meaningful reason and operator identity.

Failure handling

If a command fails

  • 401: create and protect a new credential; the current one is absent, expired, or revoked.
  • 403: confirm the operator is allowlisted and the credential includes the required scope.
  • 409: review current account or catalog state before retrying; do not force duplicate mutations.
  • API unavailable: check production readiness and retry only after service health returns.
Never put a credential directly in an npm command, command history, environment file committed to Git, CI log, or support request.