CookieSun Developers — SDK & API

Getting started (Quickstart)

The CookieSun catalog API is public (read-only). Cart and order endpoints require OAuth. Base URL: https://cookiesun.com/api. Full OpenAPI spec: /api/v3/api-docs.

# curl — list products (public)
curl https://cookiesun.com/api/catalog/products

// JavaScript / TypeScript — @cookiesun/sdk
import { CookieSunClient } from '@cookiesun/sdk'
const client = new CookieSunClient()
const products = await client.products.list()
await client.products.retrieve(18)

# Python — requests
import requests
products = requests.get("https://cookiesun.com/api/catalog/products").json()
product = requests.get("https://cookiesun.com/api/catalog/products/18").json()

// Go — net/http
resp, _ := http.Get("https://cookiesun.com/api/catalog/products")
defer resp.Body.Close()

Authentication

CookieSun uses OAuth 2.0 (Authorization Code + PKCE) via Keycloak. There is no static API key. Full walkthrough: /auth.md. Discovery metadata is at /.well-known/oauth-authorization-server. Send the token as Authorization: Bearer <token> on write requests.

MCP server

Agents can call structured tools via the MCP server at /mcp (Streamable HTTP): list_products, get_product, search_products.

Last verified: 2026-06-20 by the CookieSun team.