Authorization - Shanta API

The Website API acts for one shopper of one store. It never takes a Dashboard API key.

Who	How
Anyone	catalog, pages and store info need only `X-Website-ID`
A guest buyer	`POST /guest-tokens` once, then send the token as `X-Guest-Token` — it keeps the cart and the checkout
A signed-in buyer	`POST /auth/login` with `login`, `password`, `device_name`, then send `Authorization: Bearer <token>`

Sign-up, the one-time code and password reset are under APIs → Auth. POST /auth/logout ends one token, POST /auth/logout-all every token of the shopper.