BuyCheapKeys Partner API

Base URL: https://buycheapkeys.com/partner-api/v1. All requests and responses are JSON (UTF-8). Prices are in EUR with two decimals and do not include VAT. Dates are ISO 8601 in UTC.

• Catalogue: list and incrementally sync every product you can sell, with your partner price.
• Orders: buy up to 10 lines × 9 units per request; the total is debited from your balance at once.
• Delivery: the keys are in the response of the order and can be read again with GET /orders/{id}/keys.
• Claims: a faulty key can be claimed for 14 days from your partner dashboard, with messages and screenshots. A replacement key reaches your order automatically and a refund goes back to your balance.

Create keys in Dashboard → Partner → API keys. A key is shown once; we only store its hash. Send it in the Authorization header (X-Api-Key is accepted too).

Optional IP allowlist (IPv4/IPv6, CIDR) per account. Keys never expire unless revoked; rotate them by creating a new key and revoking the old one.

1) Create a bck_test_ key. 2) List products. 3) Place an order: it comes back completed, with the keys. 4) Read the keys again at any time with GET /orders/{id}/keys. Partner accounts still being approved can use sandbox keys.

GET /products returns up to 100 products ordered by updatedAt (then id). updatedAt only changes when something you care about changes (price, stock, name, region, texts, images). Sync with the cursor: every response has nextCursor and hasMore; pass nextCursor back as ?cursor= until hasMore is false, and keep it for the next run. It never skips or repeats products, even when many share the same timestamp. page and updatedSince remain available for browsing. Filters: inStock, platform, region, productType, deliveryType, search, ids (comma-separated, max 100).

Recommended: full sync once (no cursor), then every 5–15 minutes starting from the stored nextCursor, always with includeRemoved=true. A product with removed: true or inStock: false must not be sold.

POST /orders with externalId (your unique reference) and items (productId, qty 1–9, maxUnitPrice). For each line we check the live price: if it is above maxUnitPrice the whole order is rejected with PRICE_CHANGED and nothing is charged. If it is lower, you pay the lower price. Promo code: add couponCode: MICROSOFT20 to the order body to pay 20 % less for the Microsoft products while the promotion is active (maxUnitPrice is compared with the discounted price; an unknown code or an ended promotion returns INVALID_COUPON and nothing is charged).

• Send an Idempotency-Key header (8–100 chars) and reuse it when you retry: you get the original response and are never charged twice. externalId is also unique per account.
• The order is completed in the same request: the response has status completed and a keys array. A replayed request (same Idempotency-Key) returns the order without its keys and keysOmitted: true: read them with GET /orders/{id}/keys.
• If there is no stock or your balance is too low nothing is charged and no key is used (OUT_OF_STOCK, INSUFFICIENT_BALANCE). maxUnitPrice is a ceiling for every key; a line can be split in several items when sellers with different prices are needed.
• If a request times out, send it again with the same externalId: you get DUPLICATE_EXTERNAL_ID with the order id and can read its keys.

GET /orders/{id}/keys returns every delivered unit: value holds the code, the Steam Gift URL, the account credentials or the activation link depending on deliveryType. contentType is text/plain or an image type (then value is base64).

Store keys encrypted and show them only to the buyer. The first download of each order is logged on our side as delivery evidence.

Each key comes from a seller who is paid after a holding period, so a faulty key can be claimed for 14 days. Open the order in Dashboard → Orders (API orders), pick the key, write to the seller and attach screenshots of the activation error. The seller can send a replacement key (it appears in your order and you get the key.replaced webhook) or refund the key (the price returns to your API balance once and you get order.refunded). If you do not agree, escalate and BuyCheapKeys decides.

Check the region, excludedCountries and the licence type before selling, and show them to your customer. A refund to your balance does not refund your own customer: that is your decision.

Buy our own gift cards to resell: codes BCK-XXXX-XXXX-XXXX-XXXX that add their value to the BuyCheapKeys Wallet of whoever redeems them at buycheapkeys.com/wallet. GET /gift-cards returns the values on sale, the volume discounts, the maximums per order and your Wallet balance. POST /gift-cards/orders buys N cards of one value and returns the codes at once; GET /gift-cards/orders/{id} shows them again with the status of each code.

• Paid only from the BuyCheapKeys Wallet of your shop account (top it up at buycheapkeys.com/wallet), not from the API balance. Price = face value minus the volume discount for that quantity.
• Values, discounts and maximums can change: send maxTotal to refuse a higher total (PRICE_CHANGED, nothing charged). Idempotency-Key and the unique externalId work as for orders.
• Sale paused: PRODUCT_UNAVAILABLE (409). Value not sold or quantity out of range: VALIDATION_ERROR. Order too large: ORDER_LIMIT_EXCEEDED. Not enough Wallet balance: INSUFFICIENT_BALANCE (402).
• Sandbox keys return fake BCK-TEST-… codes that cannot be redeemed and charge nothing.
• Sold codes are final. Each code has an expiry date (expiresAt) and redemption limits per account. A code we block for fraud is no longer shown (code: null, status blocked). Store the codes encrypted.

Set an https URL in Dashboard → Webhooks; you get a signing secret (whsec_…). Every event is a POST with headers X-BCK-Event, X-BCK-Delivery (unique id — de-duplicate on it) and X-BCK-Signature: t=<unix>,v1=<hex> where v1 = HMAC-SHA256(secret, t + "." + rawBody).

• Answer 2xx within 8 s and do the work asynchronously. Redirects are not followed.
• Failed deliveries are retried after 10 s, 30 s, 1 min, 5 min, 15 min, 30 min, 1 h, 2 h, 4 h, 6 h and 12 h (~26 h).
• Events may arrive out of order or more than once: always re-read GET /orders/{id} when in doubt.

Errors use HTTP status codes and a stable code. Quote requestId when contacting support.

GET /balance returns the balance of the key's mode. Top up from Dashboard → Balance: you receive a unique reference to include in the bank transfer; the amount is credited when it arrives (e-mail + balance.credited webhook). Every movement appears in the ledger.

Machine-readable docs: https://buycheapkeys.com/developers.md (this page as Markdown), https://buycheapkeys.com/developers.es.md (Spanish), the OpenAPI 3.1 spec https://buycheapkeys.com/partner-api/v1/openapi.json and https://buycheapkeys.com/llms.txt. Give these URLs to your AI assistant together with the prompt below.

Complete reference integration (Node.js 18+, no dependencies): https://buycheapkeys.com/developers/bck-partner-client.mjs — catalogue sync with cursor, safe ordering with retries and idempotency, key download and a webhook receiver with signature verification.

• Invariant 1 — sell only products with inStock=true and removed=false; re-sync every 5–15 min from the stored nextCursor.
• Invariant 2 — one customer order = one externalId = one Idempotency-Key; reuse both on every retry.
• Invariant 3 — always send maxUnitPrice; 4xx business errors are final and nothing was charged.
• Invariant 4 — retry only network errors, 429, 5xx and IDEMPOTENCY_IN_PROGRESS, with exponential backoff.
• Invariant 5 — never re-order after a timeout: repeat the same externalId and read the keys of the existing order.
• Invariant 6 — keep the API key server-side; verify webhook signatures; show customers the deliveryType and activation region.

• Keep API keys on your server only (never in browsers or apps) and in a secret manager / environment variables.
• Use separate keys per system and the minimum scopes; enable the IP allowlist.
• Always send maxUnitPrice and an Idempotency-Key.
• Verify every webhook signature and timestamp before trusting it.
• Rotate keys and the webhook secret if you suspect a leak, then revoke the old ones.