Build on the same data your team uses.
Each channel has its own API keys, webhooks, test mode and integrations. The API reference only shows the areas your installed apps open up, so you see what you can actually call.
- Live and test keys
- Signed webhooks
- Test mode moves no money
An API that respects your roles
Create a live server key, a live publishable key for the storefront, or a test key. A server key can do everything your role can, and it is shown once, when you create it, and never again.
Webhooks send events to an HTTPS endpoint you choose. Every request is signed with your endpoint secret so you can check it came from us. Failed deliveries are retried for 24 hours, and you can replay any recent event.
Test mode lets a shop run end to end without real money: test cards and test UPI, emails marked as tests, shipping labels without a pickup, and no payouts. Clear the test data when you are done.
From a key to your first event
Create a key
Choose Create a key, then a live server key or a test key. Copy it now; it is shown once.
Read the reference
The API reference covers the areas your installed apps open up, with rate limits and error codes.
Add an endpoint
Enter an HTTPS URL, pick which events to send, add a description, then Send a test and save.
Verify signatures
Check each request’s signature with your endpoint secret before acting on it.
Handle repeats safely
The same event can arrive twice and out of order, so use the event id and object version.
Rotate or revoke
Rotating shows a new key once and keeps the old one working for 24 hours. Revoking is immediate.
Where you will find it
Sketches of the real screens in the panel, with the names you will see on them.
Live server, live publishable and test keys, with rotate and revoke.
Channel › API keysEndpoints, recent deliveries and how delivery works: signing, retries, ordering and idempotency.
Channel › WebhooksThe shop shows a banner and no money moves. Turning it off hides test data from reports.
Channel › Test modeConnect the tools you already use. Every connection lists exactly what it can see and do.
Channel › IntegrationsWhat you can set, and where the edges are
The plain facts, so nothing surprises you later.
| Setting or rule | How it works |
|---|---|
| Key types | Live server, live publishable (safe in a browser) and test server. |
| Key permissions | A server key can do everything the role of the person who created it can. |
| Rotate | The new key is shown once; the old one keeps working for 24 hours. |
| Revoke | Immediate. |
| Webhook events | All events, orders only, payments and refunds, inventory, or leads and contacts. Examples include order.paid, refund.created and lead.created. |
| Delivery | Signed with your endpoint secret, retried with back-off for 24 hours, and never silently disabled. A failing endpoint is marked and we email you. |
| API conventions | Bearer secret key, an Idempotency-Key header, cursor pagination up to 100 items a page, and 429 with Retry-After when you go over a limit. |
| Versions | Dated versions, with changes announced 90 days ahead. |
| Disconnecting an integration | Syncing stops at once. Data already brought in stays. |
Developer API: common questions
Can I limit what a key can do?
What if I lose a key?
What happens if my endpoint is down?
Can I try things without real money?
Why do I only see some API areas?
Bring your businesses under one roof
Create your User ID, add a business and open your first channel. Install only the apps you need.