API Reference

Authentication

Get an API key from your dashboard under Account → Security. Every request must include it as a Bearer token in the Authorization header:

Live keys are prefixed pk_live_. Keys can be scoped and revoked at any time from GET /account/api-keys and DELETE /account/api-keys/{key_pub_id}.

Errors

Errors are returned as JSON with a consistent shape:

{
  "error": {
    "type": "invalid_request",
    "code": "missing_parameter",
    "message": "The 'product_id' field is required."
  }
}

Rate limits

Requests are limited to 600 requests per minute per IP. Exceeding the limit returns a 429 status — back off and retry after a short delay.

Idempotency

Order and extend endpoints accept an Idempotency-Key header. Send a unique key (a UUID works well) with each new request; if a request needs to be retried after a timeout or network error, resending it with the same key guarantees it is only processed once.