Start here

Your first call in five minutes

The API lives under https://api.sellhidden.com/v1. Public endpoints need no key and are safe to call from a browser: they serve products, categories, visible reviews and recent sales for one store. Authenticated endpoints need a personal access key and manage your products, keys, orders, customers, coupons, reviews, tickets, store settings and webhooks; call them from your server only.

GET https://api.sellhidden.com/v1
# lists every endpoint with its full URL

Every response is JSON. Times are ISO 8601 in UTC. Money is USD with two decimals unless a field says otherwise. Ids are opaque strings; do not parse them.

1. 1

   Create a store and a product

   A $0 product is enough to test the whole flow without paying.

2. 2

   Read your catalogue, no key needed

   Type your store slug and press the button.

3. 3

   Create an API key

   Dashboard, Developers, API keys. The key is shown once; keep it on your server.

4. 4

   Add a webhook endpoint

   Developers, Webhooks. Subscribe to order.paid, copy the signing secret, press Send test event and check the signature with the snippet on the Webhooks page.

5. 5

   Sell from anywhere

   Add the Buy button to your site or link straight to checkout.

# 1. Your catalogue, no key needed
curl https://api.sellhidden.com/v1/public/products/my-store

# 2. Your orders, with the key from Developers, API keys
curl https://api.sellhidden.com/v1/orders?status=paid&limit=5 \
  -H "Authorization: Bearer hsk_live_…"

# 3. Receive a signed test event on your endpoint
#    (press "Send test event" in Developers, Webhooks, then verify X-Hidden-Signature)

// 1. Your catalogue, no key needed
const products = await fetch("https://api.sellhidden.com/v1/public/products/my-store").then((r) => r.json());

// 2. Your orders, with the key from Developers, API keys
const key = process.env.HIDDEN_API_KEY;
const orders = await fetch("https://api.sellhidden.com/v1/orders?status=paid&limit=5", {
  headers: { Authorization: `Bearer ${key}` },
}).then((r) => r.json());

// 3. Receive a signed test event on your endpoint
//    (press "Send test event" in Developers, Webhooks, then verify X-Hidden-Signature)

import os, requests

# 1. Your catalogue, no key needed
products = requests.get("https://api.sellhidden.com/v1/public/products/my-store").json()

# 2. Your orders, with the key from Developers, API keys
key = os.environ["HIDDEN_API_KEY"]
orders = requests.get(
    "https://api.sellhidden.com/v1/orders",
    params={"status": "paid", "limit": 5},
    headers={"Authorization": f"Bearer {key}"},
).json()

# 3. Receive a signed test event on your endpoint
#    (press "Send test event" in Developers, Webhooks, then verify X-Hidden-Signature)

<?php
// 1. Your catalogue, no key needed
$products = json_decode(file_get_contents('https://api.sellhidden.com/v1/public/products/my-store'), true);

// 2. Your orders, with the key from Developers, API keys
$key = getenv('HIDDEN_API_KEY');
$ch = curl_init('https://api.sellhidden.com/v1/orders?status=paid&limit=5');
curl_setopt_array($ch, [
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_HTTPHEADER => ['Authorization: Bearer ' . $key],
]);
$orders = json_decode(curl_exec($ch), true);

// 3. Receive a signed test event on your endpoint
//    (press "Send test event" in Developers, Webhooks, then verify X-Hidden-Signature)

Authentication

You create your own API keys and choose what each one may do: read or write, per resource. Nobody else can make a key for your store. Keys start with hsk_live_ and are shown once: we keep only a SHA-256 hash and the first characters for display. Up to 10 keys can be active per store; revoking one keeps it listed for the audit trail.

1. 1

   Open Developers, API keys

   In your dashboard. Any member of the store can open it.

2. 2

   Create a key and pick its scopes

   Name it after where it will run, tick read or write per resource, and set an expiry or an IP allowlist if you want one.

3. 3

   Copy it once

   The full key is shown one time. Keep it on your server; if it ever leaks, revoke it and make a new one.

Send the key as a Bearer token from your server:

curl \
  https://api.sellhidden.com/v1/orders?status=paid&limit=25 \
  -H "Authorization: Bearer hsk_live_…"

GET /me shows what a key can do.

Keys and scopes

Every key carries a list of scopes, one read and one write per resource; a write scope includes its read scope. Pick them when you create the key, together with an optional IP allowlist (addresses or CIDR ranges your servers call from) and an expiry. Each endpoint names the scope it needs. Writes made through the API appear in your store's audit log with the key that made them.

All 21 scopes together are shown as * (full access).