API reference
The app-proxy endpoints the storefront modal calls.
These endpoints are called by the storefront modal. They authenticate via Shopify's app-proxy HMAC (authenticate.public.appProxy), not admin session tokens. All return JSON. The base path on your storefront is /apps/codguard.
Endpoints
| Route | Method | Body | Returns |
|---|---|---|---|
/send-otp | POST | { phone } | { success } or { error } |
/verify-otp | POST | { phone, otp, selectedMode?, cartToken? } | { success } or { error } |
/create-checkout | POST | { variantId or lines[], quantity?, selectedMode, phone, productTitle? } | { checkoutUrl } or { fallback: true } |
/api/address-correction.request | POST | order / phone | status |
/api/address-correction.status | GET | token | status |
/ac/:token | GET / POST | — | Hosted address form (HTML) |
/api/auth/ping | GET | — | 200 |
/send-otp
POST /apps/codguard/send-otp
{ "phone": "+919876543210" }phone must be E.164: a leading + followed by 10–15 digits.
Enforces, in order: the shop's otpEnabled flag, the returning-customer skip, the per-number rate limit, and a billing gate.
| Status | Meaning |
|---|---|
200 | Code sent. |
402 | No active subscription. Approve a plan in the app. |
429 | Rate limit reached for this number in the current window. |
/verify-otp
POST /apps/codguard/verify-otp
{ "phone": "+919876543210", "otp": "482913", "selectedMode": "cod" }Verifies the code, marks the customer verified, and persists the payment-mode selection so the orders/create webhook can link it to the resulting order. A wrong code returns the number of attempts remaining; exhausting them returns 429.
/create-checkout
Builds the checkout and returns a URL. For cod and prepaid this is a Storefront cart of the real items with attributes and any discount applied. For partial it is a draft-order deposit checkout.
If the cart cannot be built, the response is { "fallback": true } and the modal falls back to the store's normal checkout path.