Checkout and orders

Public checkout

• POST /storefront/quote/: calculate checkout delivery and fees.
• POST /storefront/orders/place/: place an order. A valid customer JWT links it to that customer; guest checkout is supported.
• GET /storefront/orders/public/{token}/: order status for the holder of the order token.
• POST /storefront/orders/public/{token}/cancel/: request cancellation where the order state permits it.
• POST /storefront/payments/flutterwave/charge/ and GET /storefront/payments/flutterwave/status/: payment flow and status.

Treat the public order token as a secret. Do not expose it in analytics, logs or third-party URLs.

Merchant operations

GET /storefront/orders/ lists orders visible to the merchant. GET /storefront/orders/{id}/ returns one order. Status changes use action routes on that order, including ready and collect where applicable. There is no general order create/update/delete CRUD endpoint for merchants; orders are created through checkout and guarded lifecycle actions.