Download Invoice

Invoice/receipt PDF for one order.

Every caller must prove it may see the order, one of two ways:

• token = the order's invoice.token metafield (Shopify's order token, written by /shopify/order-created). Customers get it from their account page (Liquid order.metafields.invoice.token).
• exp + sig = a staff link from POST /staff/invoice-link (api/services/shopify/staff_links.py): an HMAC over "order_id|docType|exp", valid 5 minutes. The Backyard Brains admin app (order page action extension and app home) gets one with the staff member's Shopify session token. The order is then read with the API's own Admin token, so old orders work too.

A missing id, missing token/signature, unknown order, order without a stored token, wrong token, and a tampered or expired signature all return the same 404 so the endpoint does not reveal which orders exist. When token is given it is the only proof checked (the token path is unchanged). The PDF itself comes from api/services/shopify/invoice_document.py (shared with POST /site/invoice).