Shop API documentation

Authentication and API tokens

1. Sign in with the reseller login supplied by the owner.
2. Open Shop API, give the token a recognizable shop name, and select Create API token.
3. Save the full token immediately. It is displayed once. The database stores a hash, while the portal keeps a prefix for identification.
4. Store the token in your shop server's environment as FRACTURE_API_TOKEN.
5. Send Authorization: Bearer YOUR_TOKEN with every API request.

A token starts with fsk_ followed by 64 lowercase hexadecimal characters. You can have up to five active tokens. Revoke a token from the portal to stop shops using it. Create a replacement and update your server when rotating credentials.

Tokens authorize the reseller account that created them. Prices, discounts, credit balances, and ownership are resolved by the server. Keep tokens in server code and secret storage. Customer browser code should call your own authenticated shop backend.

Base URL

https://sentinelspoofs.xyz

The Cloudflare deployment address also accepts these endpoints while domain DNS changes propagate.

https://sentinelspoofs-shop.jinxyware.workers.dev

Use HTTPS. The API returns JSON and private, no-store cache headers. Key responses should also be excluded from your application caches and logs.

Credits and discounted pricing

Arrange credit purchases with the owner. The owner manually adds credits to your reseller account. The table shows the base credit costs before your assigned 40–75% reseller discount.

One credit has 100 precision units. Decimal fields ending in _credits expose credit values directly. Legacy integer fields ending in _cents store hundredths of a credit. For example, balance_credits: 4.5 equals balance_cents: 450.

The server rounds each discounted unit price upward to the next 0.01 credit, then multiplies by quantity. At 75% off, a Day key costs 1.13 credits after rounding. Three such keys cost 3.39 credits. Read the live plans endpoint for the current catalog and your account's prices.

unit_precision = ceil(base_precision × (100 − discount_percent) / 100)
total_precision = unit_precision × quantity
total_credits = total_precision / 100

Endpoints

GET /api/v1/balance

Read your available credit balance and reseller discount. No request body is required.

curl 'https://sentinelspoofs.xyz/api/v1/balance' \
  -H "Authorization: Bearer $FRACTURE_API_TOKEN"

{
  "balance_credits": 100,
  "balance_cents": 10000,
  "discount_percent": 40,
  "unit": "credits",
  "credit_scale": 100
}

GET /api/v1/plans

Read active plans, durations, base costs, and the discounted costs applied to your account. No request body is required. A duration_secs value of zero represents the Lifetime temporary-access license.

curl 'https://sentinelspoofs.xyz/api/v1/plans' \
  -H "Authorization: Bearer $FRACTURE_API_TOKEN"

{
  "plans": [{
    "id": "temp_1day",
    "name": "1 Day",
    "duration": "1day",
    "duration_secs": 86400,
    "price_credits": 4.5,
    "price_cents": 450,
    "discounted_price_credits": 2.7,
    "discounted_price_cents": 270
  }],
  "unit": "credits",
  "credit_scale": 100
}

The example lists one plan. The live response includes every active plan.

POST /api/v1/orders

Generate keys and debit credits in one database transaction. Authenticate with your API token and send a JSON body with a plan ID from the plans response and an integer quantity from 1 to 500.

The account and debit price come from your API token and the live catalog. Send only the plan and quantity. The server owns pricing and account selection.

curl -X POST 'https://sentinelspoofs.xyz/api/v1/orders' \
  -H "Authorization: Bearer $FRACTURE_API_TOKEN" \
  -H 'Content-Type: application/json' \
  -H 'Idempotency-Key: myshop:order:123456' \
  -d '{"plan_id":"temp_1day","quantity":1}'

Successful order response

{
  "id": "11111111-1111-4111-8111-111111111111",
  "plan_id": "temp_1day",
  "quantity": 1,
  "keys": ["FRACTURE-XXXX-XXXX-XXXX-XXXX"],
  "unit_price_credits": 2.7,
  "unit_price_cents": 270,
  "total_credits": 2.7,
  "total_cents": 270,
  "balance_credits": 97.3,
  "balance_cents": 9730,
  "replayed": false
}

HTTP 200 returns the order ID, generated keys, quantity, plan, debit amounts, and remaining balance. Example IDs and keys here are placeholders. Deliver the keys only to the customer associated with your verified paid shop order.

Order retries and idempotency

Use a stable server-side shop order reference for the Idempotency-Key header, such as myshop:order:123456. Persist it with the shop order before requesting keys.

• A new request generates keys and deducts the total once.
• Repeating the same key, plan, and quantity returns the original order and keys with HTTP 200 and replayed: true. It does not debit credits again.
• Reusing the same key with a different plan or quantity returns HTTP 409.
• After a timeout, connection failure, HTTP 429, or temporary service failure, retain the original key and body. Retry with backoff. Honor Retry-After when present.
• The returned balance is the account balance at the time of the response. It can differ between the first request and a later replay.

Your own payment-event handling and customer delivery must also be idempotent. Save the Fracture order ID and keys against the paid shop order before sending the fulfillment message.

Errors and rate limits

Errors have the JSON shape {"error":"Readable error message"}. Treat the HTTP status as the stable signal.

Limits apply across the integration endpoints at 60 requests per token per minute and 120 requests per source IP per minute. HTTP 429 includes Retry-After: 60. Coordinate requests when several shops share a token or network address.

Server integration examples

Call these functions from your existing payment handler after it verifies the provider's event signature, checks the paid state, and maps the purchased product to a Fracture plan. Keep the same shop order ID through retries.

Node.js

// Run in your shop server after verifying a paid payment event.
// Persist this shop order ID and reuse it on every retry.
export async function fulfillPaidShopOrder(shopOrderId, planId, quantity) {
  const token = process.env.FRACTURE_API_TOKEN;
  if (!token) throw new Error('Missing FRACTURE_API_TOKEN');

  const response = await fetch('https://sentinelspoofs.xyz/api/v1/orders', {
    method: 'POST',
    headers: {
      Authorization: 'Bearer ' + token,
      'Content-Type': 'application/json',
      'Idempotency-Key': 'myshop:order:' + shopOrderId,
    },
    body: JSON.stringify({ plan_id: planId, quantity }),
    signal: AbortSignal.timeout(30000),
  });
  const body = await response.json();
  if (!response.ok) {
    // Retain the same order ID for retryable failures.
    // On 429, wait at least Retry-After seconds.
    const error = new Error(body.error || 'Fracture fulfillment failed');
    error.status = response.status;
    error.retryAfter = response.headers.get('retry-after');
    throw error;
  }

  // Save body.id and body.keys against the paid shop order.
  // Make local customer delivery idempotent too.
  return body;
}

Python standard library

# Run on your shop server after verifying a paid payment event.
import json
import os
from urllib.request import Request, urlopen
from urllib.error import HTTPError

def fulfill_paid_shop_order(shop_order_id, plan_id, quantity):
    token = os.environ['FRACTURE_API_TOKEN']
    request = Request(
        'https://sentinelspoofs.xyz/api/v1/orders',
        method='POST',
        headers={
            'Authorization': 'Bearer ' + token,
            'User-Agent': 'Fracture-Shop-Integration/1.0',
            'Content-Type': 'application/json',
            'Idempotency-Key': 'myshop:order:' + str(shop_order_id),
        },
        data=json.dumps({'plan_id': plan_id, 'quantity': quantity}).encode(),
    )
    try:
        with urlopen(request, timeout=30) as response:
            result = json.load(response)
    except HTTPError as error:
        # Keep shop_order_id unchanged when retrying.
        # Honor error.headers.get('Retry-After') for HTTP 429.
        detail = json.loads(error.read().decode())
        raise RuntimeError(
            f"Fracture HTTP {error.code}: {detail.get('error', 'Request failed')}"
        ) from error

    # Persist result['id'] and result['keys'] before delivering to the buyer.
    return result

Fulfillment sequence

1. Verify the paid shop event on your server.
2. Load the saved shop order and derive its plan and quantity.
3. Use its persistent reference as the idempotency key.
4. Request keys from Fracture and save the response to that order.
5. Deliver the saved keys once through your shop's customer channel.

For tooling and generated clients, download the OpenAPI 3.1 specification.