canonical: https://jentic.com/apis/gadget.app/gadget # Gadget App Staff Validate API The Staff Validate API confirms, server-to-server, that a given user identity belongs to an installed Shopify shop before a backend grants shop-scoped access. A single request supplies a shop id, a user id, and an email, and the API returns success only when the shop is in the installed state, the user id matches the shop's merchant record, and the email matches the shop's customer email. It is built for backend calls rather than client-side use, and it returns distinct responses for a missing field, an unauthorized request, a failed match, and a shop that cannot be found. ## For AI agents Verify that a user id and email belong to an installed Shopify shop in a single server-to-server call. Authenticates with an API secret key in a request header. ## Scope Does not create users, manage sessions, or issue login tokens. Use for verifying that a user identity belongs to an installed Shopify shop only. ## Capabilities - Verify that a user id and email match the merchant record of an installed Shopify shop - Confirm server-to-server that a staff member is authorized for a specific shop before granting access - Distinguish a failed identity match from a missing shop or an unauthorized request through the API's status responses ## Use cases ### Agent-Gated Shop Access An AI agent connected through Jentic validates a staff identity against an installed Shopify shop before it performs a shop-scoped action, so access decisions are made against the merchant record rather than assumed. The agent passes the shop id, user id, and email and only proceeds when the API returns a successful match. Example prompt: Validate that this user id and email belong to the installed Shopify shop, then proceed only if the response is a successful match ### Server-to-Server Staff Verification A backend service verifies that an incoming request's staff identity matches the shop's merchant record before acting on it, using a single call that checks the shop's installed state, merchant id, and customer email together. Because the check is designed for server-to-server use, the API secret key stays out of any client-side code. Example prompt: Call the staff-validation endpoint with the shop id, user id, and email and return whether the identity was validated ### Pre-Action Authorization Gate Before a workflow runs a shop-scoped task, it calls the staff-validation endpoint and branches on the result: a success proceeds, while a forbidden or not-found response stops the task and surfaces the reason. This turns the single validation call into a reusable authorization gate for any shop-scoped automation. Example prompt: Check the staff identity for this shop and stop the workflow if the API returns a forbidden or not-found response ## Key resources - **Staff Validation** — A single operation that checks a shop id, user id, and email against a shop's merchant record ## AI readiness This API is usable in Jentic One now. Its AI-readiness score against Jentic's framework shows where it stands today and where improvements would make it even easier for agents to use. - **Score:** 73 / 100 - **Maturity:** AI-Aware - **Dimensions:** - Foundational Compliance: 100 / 100 - Developer Experience & Jentic Compatibility: 86 / 100 - AI-Readiness & Agent Experience: 58 / 100 - Agent Usability: 94 / 100 - Security: 50 / 100 - AI Discoverability: 75 / 100 - **View full report:** https://jentic.com/apis/gadget.app/gadget/scorecard - **How the score is calculated:** https://docs.jentic.com/reference/api-readiness-framework/overview/ - **More about the dimensions:** https://docs.jentic.com/reference/api-readiness-framework/specification/#dimensional-model-overview ### Score it yourself Every API in the directory is allowlisted, so you can re-score it with no key required. - **Score your own API:** https://jentic.com/scorecard.md - **Scoring CLI agent skill:** https://github.com/jentic/jentic-api-scorecard/blob/main/skills/jentic-api-scorecard/SKILL.md ```sh npx @jentic/api-scorecard-cli score ``` ## Why Jentic - **Setup:** Wiring the Staff Validate API by hand means handling its API-secret-key header, keeping that key off any client and strictly server-to-server, and branching on its distinct success, forbidden, and not-found responses yourself. Through Jentic you install once, import the API from the Directory, store the key once, and your agent calls it. - **Permission scoping:** The Staff Validate API exposes a single validation operation, so a rule can allow your agent to call that one operation and nothing else. The shop id, user id, and email travel in the request body, so your rules bound which operation runs rather than which shop, and every call is logged. - **Credential handling:** Your API secret key is stored once, encrypted, by your own Jentic One instance and injected at execution time. It never enters the agent's prompt, client-side code, logs, or context. - **Discovery method:** Agents search Jentic by intent such as 'verify a user belongs to a Shopify shop', and Jentic returns the matching Staff Validate operation with its input schema so the agent supplies the shop id, user id, and email correctly. ## Related APIs - **Shopify Admin API** — The Shopify platform whose installed shops and merchant records this API validates against - **Auth0 API** — Full identity platform for user login, sessions, and token issuance - **Clerk Backend API** — User management and authentication backend for verifying and managing user identities - **TruAnon API** — Identity verification service for confirming that a user is who they claim to be ## FAQ ### Is there a Staff Validate MCP server? You don't need an MCP server to give your agent the Staff Validate API. Jentic connects it directly from the API Directory: import it, store your credential once, and your agent can validate staff identities straight away, with no extra server to run and no tool definitions to load into the agent's context. ### Can I limit what my agent is allowed to do with the Staff Validate API? Yes. The API exposes a single staff-validation operation, so a rule can allow your agent to call that operation and nothing else. The shop id, user id, and email travel in the request body, so your rules bound which operation runs, and every call the agent makes is logged. ### What authentication does the Staff Validate API use? The Staff Validate API uses an API secret key sent in the `X-Api-Key` header per its OpenAPI spec, and it is designed for server-to-server calls only. Through Jentic the key is stored encrypted by your own instance and added to each request at call time, so it never appears in the agent's prompt, client-side code, or logs. ### What does a successful Staff Validate response mean? A success is returned only when the shop is in the installed state, the supplied user id matches the shop's merchant record, and the email matches the shop's customer email. A forbidden response means the shop exists but is not installed or the identity did not match, and a not-found response means the shop id was not recognised. ### What are the rate limits for the Staff Validate API? The OpenAPI spec does not specify rate limits for the Staff Validate API. For current limits and usage guidance, check the documentation for your Gadget application that hosts this endpoint. ### How do I validate a staff identity through Jentic? Import the Staff Validate API from the Jentic API Directory, then have your agent issue a request such as 'verify this user belongs to the installed Shopify shop'. Jentic matches the intent to the validate-staff operation and returns its input schema so the agent supplies the shop id, user id, and email correctly, with your stored key injected at call time. To run it on your own infrastructure, install Jentic One from its GitHub repo.