Customer API

The Customer API lets you build customer-facing applications where customers can view their own profile, order history, bookings, memberships, and enquiries. It is designed for use in browsers, mobile apps, and any client-side environment.

Base URL

https://edge.tiquo.app/api/client/v1

Authentication

Every request to the Customer API requires a valid JWT access token in the Authorization header. Tokens are issued to customers through one of two authentication methods:

• DOM Package - Email OTP flow for browser-based apps
• OAuth/OIDC - Authorization code flow for more complex integrations

Authorization: Bearer eyJhbGciOiJSUzI1NiJ9...

Access tokens expire after 1 hour. Use the refresh endpoint to get a new token pair before the current token expires.

See Customer Authentication with the DOM Package and Customer Authentication with OAuth/OIDC for more details on how tokens are obtained and managed.

CORS

The Customer API supports CORS for browser-based requests. All origins are allowed since access is controlled through token-based authentication rather than origin restrictions.

Available Endpoints

Data Scope

All Customer API responses are scoped to the authenticated customer. A customer can only see their own data. There is no way to access another customer's records through this API.

Rate Limits

Rate limits are applied per user. If a customer exceeds the limit, they will receive a 429 status code until the window resets.

Response Format

All responses follow a consistent structure:

{
  "success": true,
  "data": { ... }
}

Error responses:

{
  "success": false,
  "error": "Invalid or expired token"
}

Common Errors