Mercemur gives every merchant three doors into the same store: a REST API to call from code, an MCP server so an AI agent can act on it directly, and a CLI to edit a storefront as files on your own machine. All three are governed by the same secret key and the same scopes, one grant, whichever door you use.

​
Start here

API

571 operations across catalogue, orders, customers, pricing, and money. Call it from any platform that can send an HTTP request.

MCP

Point an AI client, Claude Desktop, an IDE, another agent, at one endpoint and it can read and write your live storefront.

CLI

Pull your storefront to disk, edit it in your own editor with live preview, and publish when you’re ready.
REST API base URL for every request: https://api.mercemur.com/api/v1 · MCP endpoint: https://mcp.mercemur.com/mcp

​
The REST API in detail

Quickstart

Create a key and make your first call in under five minutes.

API reference

Every endpoint, with a playground you can fire against your own store.

Rate limits

Understand throttling and how to back off correctly.

​
Authentication and security

API keys

Secret keys, how to create them, and how to rotate one safely.

Scopes

Read, write and delete are separate grants. 136 scopes across 66 families.

Error handling

One envelope for every refusal, at every status.

​
Making requests

Idempotency

Every write takes an Idempotency-Key. Retry safely.

Pagination

Cursor paging, forward only, signed and bound to the route that issued it.

Money

Every amount is an integer in the currency’s minor unit.

​
The four things that are not guessable from one endpoint

If you read nothing else, read these. They are the conventions that a single example request will not teach you, and each one has bitten an integration.
1999 in a usd field is 19.99 USD. There are no fractional amounts anywhere in this API, and no field accepts a decimal. Currencies with no minor unit, such as JPY, take the whole number directly. See Money.
write_products does not let a key read your catalogue, and deleting is a third grant again: write_products:delete. A key that keeps records up to date cannot destroy them unless you tick Delete as well. See Scopes.
Not optional, and not only for retries. A request without the header is refused with idempotency_key_required. Replaying the same key returns the stored response rather than executing twice. See Idempotency.
There is no page or offset parameter. You send ?after= with the page.next_cursor from the previous response for that same endpoint. A cursor from a different collection is refused. See Pagination.

​
Branch on code, never on message

Every refusal on this API, at every status, has the same body:
The code is the contract and is safe to switch on. The message is English prose for a human reading a log, and its wording is not part of this contract. See Error envelope.