Developer docs
Build with AI
Tell the assistant what you want. It reads these docs and writes the code with you.
Prompt builder
What do you want to build?
Which language?
Your prompt
Read https://docs.sellhidden.com/llms-full.txt. It is the complete documentation of the Hidden API in one file. Help me connect my Hidden store (sellhidden.com) to my own code. Ask me first what I want to build: show my products on my website, get a message when an order is paid, deliver from my own server, or manage my store from code. Ask which language I use. Then write the integration step by step. Base URL https://api.sellhidden.com/v1. Ask me for my API key before any call, keep it in an environment variable, never log it and never put it in a URL or a chat message. Send Idempotency-Key on every POST. Every call is live: there is no test mode. I use curl.
Files for AI tools
Every page is also Markdown: add .md to its address.
hidden-api-docs.md
https://docs.sellhidden.com/llms-full.txt
Every page in one file. Give it to your AI assistant.
llms.txt
https://docs.sellhidden.com/llms.txt
The index: one line per page with its Markdown address.
hidden-openapi.json
https://docs.sellhidden.com/openapi.json
OpenAPI 3.1: every path, field and scope.
hidden-postman.json
https://docs.sellhidden.com/postman.json
Postman collection, one folder per group.
Rules for your coding tool
Save this file as AGENTS.md in your project, or wherever your tool reads its rules. Your tool then knows the Hidden API on every later task.
AGENTS.mdmd
# Hidden API: rules for coding tools
- Base URL https://api.sellhidden.com/v1. Public endpoints need no key. Authenticated endpoints take `Authorization: Bearer <key>`.
- Ask the user for their API key and store slug. Never print, log or commit the key; keep it in an environment variable.
- Send `Idempotency-Key` on every POST.
- Verify every webhook: HMAC-SHA256 of `${X-Hidden-Timestamp}.${rawBody}` with the endpoint secret, compared in constant time; reject timestamps older than 5 minutes; dedupe by X-Hidden-Delivery; answer 2xx within 15 seconds.
- There is no test mode: every call is live. Use a $0 product or a temporary key from the Try it panel to test.
- Orders are created by buyers at checkout; the API manages them afterwards.
## Endpoints
Base URL https://api.sellhidden.com/v1
Authorization: Bearer <key>
- Products: GET /products, POST /products, GET /products/{id}, PATCH /products/{id}, DELETE /products/{id}, GET /products/{id}/variations, POST /products/{id}/variations, GET /products/{id}/variations/{variationId}, PATCH /products/{id}/variations/{variationId}, DELETE /products/{id}/variations/{variationId}, GET /products/{id}/keys, POST /products/{id}/keys, DELETE /products/{id}/keys, POST /products/{id}/stock — scope products:read / products:write
- Categories: GET /categories, POST /categories, GET /categories/{id}, PATCH /categories/{id}, DELETE /categories/{id}, POST /categories/reorder — scope categories:read / categories:write
- Coupons: GET /coupons, POST /coupons, GET /coupons/{id}, PATCH /coupons/{id}, DELETE /coupons/{id} — scope coupons:read / coupons:write
- Orders: GET /orders, GET /orders/{id}, POST /orders/{id}/approve, POST /orders/{id}/reject, POST /orders/{id}/cancel, POST /orders/{id}/redeliver, POST /orders/{id}/resend-receipt, POST /orders/{id}/refund, PUT /orders/{id}/note, DELETE /orders/{id}/note — scope orders:read / orders:write
- Subscriptions: GET /subscriptions, GET /subscriptions/{id}, POST /subscriptions/{id}/cancel, POST /subscriptions/{id}/extend — scope subscriptions:read / subscriptions:write
- Customers: GET /customers, GET /customers/{id}, POST /customers/{id}/balance, POST /customers/{id}/ban, DELETE /customers/{id}/ban — scope customers:read / customers:write
- Reviews: GET /reviews, GET /reviews/{id}, PATCH /reviews/{id}, PUT /reviews/{id}/reply, DELETE /reviews/{id}/reply — scope reviews:read / reviews:write
- Tickets: GET /tickets, GET /tickets/{id}, POST /tickets/{id}/messages, PATCH /tickets/{id}, POST /tickets/{id}/close — scope tickets:read / tickets:write
- Store: GET /store, PATCH /store — scope store:read / store:write
- Webhooks: GET /webhooks, POST /webhooks, GET /webhooks/{id}, PATCH /webhooks/{id}, DELETE /webhooks/{id}, POST /webhooks/{id}/rotate-secret, POST /webhooks/{id}/test, GET /webhooks/{id}/deliveries — scope webhooks:read / webhooks:write
- Analytics: GET /analytics — scope analytics:read
- Your key: GET /me — any key
## Webhooks
- Every delivery is a signed POST: X-Hidden-Event, X-Hidden-Delivery, X-Hidden-Timestamp, X-Hidden-Signature (sha256=HMAC-SHA256 of `${timestamp}.${rawBody}` with the endpoint secret). Verify before you trust the payload.
Docs index: https://docs.sellhidden.com/llms.txtGet help
Send us the endpoint, the request or delivery id and the response you got. Security findings go through responsible disclosure. Live platform status is on the support page.
See also