# Build a storefront on the Organization API

> Which Organization API serves each part of your own storefront, and which credential each one takes.

Source: https://docs.coritan.com/organizations/storefront/

Your storefront is the site where your customers browse your products, sign in, order, pay and run what they bought. You build it yourself on the Organization API, which gives the site everything it needs under `https://api.coritan.com/api/v1/orgs/{org_slug}`. Each part of the API takes its own credential, so the browser never holds a key that could change your organization.

## The APIs a storefront uses

| API | Paths | Credential | What it serves |
| --- | --- | --- | --- |
| [Storefront API](/organizations/storefront/storefront-api/) | `/storefront/...` | None, except for ordering and paying | Branding, products, locations, currencies, status and notices, and placing an order |
| [Customer sign-in](/organizations/storefront/customer-sign-in/) | `/auth/...` | None to register or sign in, then the customer's token | Accounts, tokens, email verification, password resets, two-factor authentication and social sign-in |
| Customer portal | `/portal/...` | The customer's token | Everything a signed-in customer does with their account, services and invoices |
| [Community](/organizations/storefront/community/) | `/storefront/community/...` and `/portal/community/...` | None to read, the customer's token to post | A server list, a forum, guides and your Discord chat |
| [Store API](/organizations/storefront/store-api/) | `/store/...` | A publishable key, plus the shopper's token for their own orders | Carts, checkout and orders for a store run with the Commerce API |
| [Commerce API](/organizations/storefront/commerce-api/) | `/commerce/...` | An [organization API key](/organizations/api-keys/) or a member's token | Running that store from your own systems |

The customer portal has one page per product:

- [Build the customer account area](/organizations/storefront/customer-portal/): profile, services, invoices, credit, payment methods and refunds.
- [Let customers run their servers](/organizations/storefront/portal-servers/) on Container Apps.
- [Let customers run Cloud Compute instances](/organizations/storefront/portal-cloud-compute/).
- [Let customers manage IPs, protection and domains](/organizations/storefront/portal-networking/): Floating IPs, DDoS Shield, external servers and platform domain names.
- [Let customers use Mail Hosting and SMTP Relay](/organizations/storefront/portal-mail/).

## Two ways to sell

Most organizations sell services: the products and prices you set up on the **Products** tab, which customers order through the Storefront API and pay by invoice. [Set up products and pricing](/organizations/products-and-pricing/) explains them.

The Store API and the Commerce API run a separate store for goods, with carts, shipping and fulfilment, which Coritan sells as merchant of record on your behalf. Coritan turns the store on for an organization; until then its routes answer `404` with `commerce_not_enabled`. In the dashboard, the store is the organization's **Commerce** tab ([Run your store from the Commerce tab](/organizations/commerce/)).

## How it is billed

Your customers pay your organization at your prices, and Coritan pays you what it collected less the platform fee. [Organization billing](/organizations/billing/) explains both sides.

## Rules for every route

- The routes answer only while your organization is `active`. For any other status they answer `404 Organization not found`.
- A customer token belongs to one organization. Sent to another organization's routes, it is refused.
- Anonymous `GET` requests to public routes send `Cache-Control` headers that let browsers and caches keep the answer for up to 30 seconds, and serve it for 30 seconds more while they fetch a new one. A change to your catalogue or branding can take that long to show.