Authentication is a two-tier token chain:
v1/company/auth with your secret to receive a company-level auth_token. This token identifies your business (vendor) and is required to fetch the catalogue.v1/customer/auth, passing the company auth_token in the Authorization header, to receive a per-customer customer_token. This token identifies an individual end-customer for order creation. It is an identity/session token only — Bigcity does not track or manage customer loyalty points/balance, that remains the responsibility of your platform.Security note: both tokens must only ever be requested and used server-to-server, from your backend. Never call these APIs, or embed your company secret, directly from a customer-facing app or browser.