Shoppex
Start free

A developer API with 313 operations.

Orders, products, licenses, webhooks and storefront themes under one base URL and one scoped key. SDKs, a CLI and two MCP servers are on the Free plan too.

Start freeRead the docs
POST /dev/v1/ordersIdempotency-Key: order-1042{ "email": "[email protected]", "items": [{ "product_id": "prod_starter", "quantity": 1 }] }
201 Created"status": "PENDING","checkout_url": "https://…","items": [{ "delivery_status": "PENDING" }]
FreeThe API, webhooks, OAuth apps, scoped keys, SDKs, the CLI and both MCP servers are on the Free plan.Business, 99 EUR a month, adds the headless checkout SDK and email broadcast campaigns.
313Documented operations, all in one OpenAPI 3.0.3 file you can generate a client from.
53Webhook events. Every delivery is signed with your webhook's own secret and sent up to five times.
What it reaches

One base URL for products, orders and themes.

Everything sits under api.shoppex.io/dev/v1. These are its route groups, each with the number of operations it has.

Sell

  • /orders12
  • /invoices6
  • /payments5
  • /payment-links6
  • /checkout1
  • /coupons6
  • /escrow3

Catalogue

  • /products51
  • /categories5
  • /groups5
  • /licenses9
  • /shipping-zones5
  • /replacement-events2

Customers

  • /customers11
  • /subscriptions10
  • /tickets6
  • /reviews3

Grow

  • /telegram36
  • /affiliates19
  • /email-marketing17
  • /resellers5
  • /reseller-program2
  • /reseller-tiers1
  • /analytics1

Protect

  • /security8
  • /blacklist4
  • /allowlist4
  • /disputes2

The shop itself

  • /store16
  • /workflows16
  • /themes12
  • /webhooks11
  • /code-storefronts9
  • /me2
  • /oauth2
  • A key for one job29 resources, scoped as read, write or send. Start from a preset or pick scopes one resource at a time.
  • OAuth for apps other people installAuthorization code with PKCE and refresh tokens, so an app your customer installs never holds your key.
  • A key bound to one themeApart from /dev/v1/me, it reaches that theme and nothing else in the shop, which is what you give a coding agent.
Built to be retried

A retry with the same key can't create a second payment.

Every route that writes takes an idempotency key, apart from the OAuth token exchange, and a test in the build fails when a new route ships without one.

  • A 24 hour windowA replay matches on your API key, the route and the idempotency key. Send it as Idempotency-Key or X-Idempotency-Key.
  • A different body is refusedReusing a key with another body is refused, on most routes with 422 VALIDATION_ERROR, instead of guessing which one you meant.
  • Rate limits in the headersX-RateLimit-Limit, -Remaining and -Reset on authenticated calls, plus Retry-After when you are blocked.
The requestPOST /dev/v1/paymentsIdempotency-Key: payment-create-123{ "title": "Order #1001", "value": 49.99, "currency": "USD" }
  1. #2201Idempotency-Status: cached
  2. #1201Idempotency-Status: created
Requests sent2
Payments created1

2 requests sent with one key, 1 payment created.

Webhooks

Webhooks you can verify, retry and rotate.

53 events across orders, disputes, products, subscriptions, resellers, affiliates, feedback and support queries. Every delivery is signed with your webhook's own secret. Try to slip one past the check.

  • Test it, retry it, rotate itSend a test delivery, retry a failed one from the dashboard or with POST /webhooks/logs/{id}/retry, rotate a secret with one call. Each webhook has its own.
  • Your server can do the deliveringA dynamic product calls your URL after payment. Your answer is the key, the account or the link, or {"status":"pending"} to fulfil it later through the API.
  • The same event can arrive twiceStore the delivery ID and return success for one you have seen. Most order payloads are frozen when the delivery is queued, so an automatic retry carries the original state.
Arrives at your endpointX-Shoppex-Event: order:paidX-Shoppex-Timestamp: 1759855200X-Shoppex-Signature-V2: v1,t=1759855200,h=…{"event":"order:paid", … "total":49.99, "currency":"USD"}
Your server checkscomputes h=…no matchsent 2 s ago, limit 5 minfreshReject before parsing401

Rejected with 401: the signature does not match.

SDKs, CLI and AI clients

Your language, your terminal, your assistant.

Typed SDKs and a CLI wrap /dev/v1, and two MCP servers let Claude, Cursor and the rest call the same API. All six are on the Free plan.

TypeScriptnpm install @shoppexio/sdkA typed client for /dev/v1. It holds your API key, so it runs on your server.
Pythonpip install shoppexioThe same API and the same scopes, from Python.
PHPcomposer require shoppexio/shoppex-phpThe same API and the same scopes, from PHP.
CLInpm install -g @shoppexio/cliPulls a storefront to a folder and deploys it back once the build is COMPLETED.
Hosted connectorhttps://api.shoppex.io/mcpFor claude.ai, the desktop and mobile apps, Cowork and Claude Code. You approve it once with OAuth.
Local MCP servernpx @shoppexio/mcp-shoppex installFor Claude Desktop, Claude Code, Cursor, Windsurf and Codex, with your own API key.
  • Keep the SDK on your server@shoppexio/sdk holds an API key, so it never goes into browser code. Storefronts in the browser use @shoppexio/storefront.
  • 72 tools, every change marked65 for commerce and 7 for themes; the hosted connector has 71. Each is marked read-only or as a change, so your assistant can ask before it runs one, depending on your client's permission settings.
  • Two lines sit on BusinessThe headless checkout SDK, which runs on your own site, and email broadcast campaigns are sold with the 99 EUR plan. The rest is on Free.
FAQ

Developer FAQ

What does the API cost?

There is no API fee on top of the 2% sale fee. The API, webhooks, OAuth apps, SDKs, CLI and MCP servers are on the Free plan. Business adds the headless checkout SDK and email broadcast campaigns.

Is there an OpenAPI file?

Yes, at docs.shoppex.io/openapi.json, version 3.0.3 with 313 operations. Generate a client in any language from it, or call the REST API with plain HTTP.

How do I verify a webhook?

Compute HMAC-SHA256 over deliveryId.timestamp.rawBody with your webhook's secret, and compare it in constant time with the h value in X-Shoppex-Signature-V2. Check that its t value matches X-Shoppex-Timestamp, reject a timestamp more than 5 minutes away from your clock, and verify the raw body before you parse it.

Can an AI client refund an order?

Not over MCP: neither server has a refund tool, and the hosted connector leaves out the customer wallet credit tool as well. Your own server can refund through POST /dev/v1/orders/{id}/refund, with a key that has the orders write scope.

Make a key and send your first call.

Create your shop, open Settings, generate an API key with the scopes you need, and call /dev/v1/me.

Start freeAsk us on Discord