Doeh POS — Consumer Mobile API (1.0.0)

Consumer authentication failed — the publishable key or the customer bearer did not resolve. code is one of the values below (stable, append-only ABI). CUSTOMER_TOKEN_INVALID covers every way a bearer fails to name a customer for THIS API — expired, revoked, unknown, or minted for a different audience — with no further detail, deliberately. Internal edge↔Core signature/transport errors are not part of the public contract.

Authenticated, but the operation is not permitted for this consumer app (capability is server-derived from the key; clients never send it).

OAuth (delegated) tokens only. The resource is not visible to this application: the customer is not a member of the key's shop, OR the customer has not consented (or has revoked consent) to this application for this operation. These cases are DELIBERATELY indistinguishable — whether a person is a member of a shop is theirs to disclose, so an app without a live grant cannot use the status code as a membership probe. If you received a 404 where you expected data, re-run the authorization flow: it renews consent when consent is what's missing. First-party session tokens never receive this response (a shop's own app may know its members; it gets 401 CUSTOMER_NOT_LINKED instead).

The key's shop is unknown or the plugin/program is not enabled for it.

Consumer authentication failed — the publishable key or the customer bearer did not resolve. code is one of the values below (stable, append-only ABI). CUSTOMER_TOKEN_INVALID covers every way a bearer fails to name a customer for THIS API — expired, revoked, unknown, or minted for a different audience — with no further detail, deliberately. Internal edge↔Core signature/transport errors are not part of the public contract.

Authenticated, but the operation is not permitted for this consumer app (capability is server-derived from the key; clients never send it).

OAuth (delegated) tokens only. The resource is not visible to this application: the customer is not a member of the key's shop, OR the customer has not consented (or has revoked consent) to this application for this operation. These cases are DELIBERATELY indistinguishable — whether a person is a member of a shop is theirs to disclose, so an app without a live grant cannot use the status code as a membership probe. If you received a 404 where you expected data, re-run the authorization flow: it renews consent when consent is what's missing. First-party session tokens never receive this response (a shop's own app may know its members; it gets 401 CUSTOMER_NOT_LINKED instead).

The key's shop is unknown or the plugin/program is not enabled for it.

Consumer authentication failed — the publishable key or the customer bearer did not resolve. code is one of the values below (stable, append-only ABI). CUSTOMER_TOKEN_INVALID covers every way a bearer fails to name a customer for THIS API — expired, revoked, unknown, or minted for a different audience — with no further detail, deliberately. Internal edge↔Core signature/transport errors are not part of the public contract.

Authenticated, but the operation is not permitted for this consumer app (capability is server-derived from the key; clients never send it).

OAuth (delegated) tokens only. The resource is not visible to this application: the customer is not a member of the key's shop, OR the customer has not consented (or has revoked consent) to this application for this operation. These cases are DELIBERATELY indistinguishable — whether a person is a member of a shop is theirs to disclose, so an app without a live grant cannot use the status code as a membership probe. If you received a 404 where you expected data, re-run the authorization flow: it renews consent when consent is what's missing. First-party session tokens never receive this response (a shop's own app may know its members; it gets 401 CUSTOMER_NOT_LINKED instead).

The key's shop is unknown or the plugin/program is not enabled for it.

Rejected by the loyalty program's business rules — program inactive, below the minimum redeemable points, or insufficient balance. Nothing was written.

Consumer authentication failed — the publishable key or the customer bearer did not resolve. code is one of the values below (stable, append-only ABI). CUSTOMER_TOKEN_INVALID covers every way a bearer fails to name a customer for THIS API — expired, revoked, unknown, or minted for a different audience — with no further detail, deliberately. Internal edge↔Core signature/transport errors are not part of the public contract.

Authenticated, but the operation is not permitted for this consumer app (capability is server-derived from the key; clients never send it).

OAuth (delegated) tokens only. The resource is not visible to this application: the customer is not a member of the key's shop, OR the customer has not consented (or has revoked consent) to this application for this operation. These cases are DELIBERATELY indistinguishable — whether a person is a member of a shop is theirs to disclose, so an app without a live grant cannot use the status code as a membership probe. If you received a 404 where you expected data, re-run the authorization flow: it renews consent when consent is what's missing. First-party session tokens never receive this response (a shop's own app may know its members; it gets 401 CUSTOMER_NOT_LINKED instead).

The key's shop is unknown or the plugin/program is not enabled for it.