BuyCheapKeys Partner API

Base URL: https://buycheapkeys.com/partner-api/v1. All requests and responses are JSON (UTF-8). Prices are in EUR with two decimals and do not include VAT. Dates are ISO 8601 in UTC.

• Catalogue: list and incrementally sync every product you can sell, with your partner price.
• Orders: buy up to 10 lines × 9 units per request; the total is debited from your balance at once.
• Delivery: keys, Steam Gift links, account credentials or activation links, via API or webhook.
• Refunds: units that could not be delivered are credited back automatically. Delivered keys, Steam Gifts, accounts and links are final: they cannot be returned or refunded.

Create keys in Dashboard → Partner → API keys. A key is shown once; we only store its hash. Send it in the Authorization header (X-Api-Key is accepted too).

Optional IP allowlist (IPv4/IPv6, CIDR) per account. Keys never expire unless revoked; rotate them by creating a new key and revoking the old one.

1) Create a bck_test_ key. 2) List products. 3) Place an order with ?wait=20 to receive it already completed. 4) Download the keys.

GET /products returns up to 100 products ordered by updatedAt (then id). updatedAt only changes when something you care about changes (price, stock, name, region, texts, images). Sync with the cursor: every response has nextCursor and hasMore; pass nextCursor back as ?cursor= until hasMore is false, and keep it for the next run. It never skips or repeats products, even when many share the same timestamp. page and updatedSince remain available for browsing. Filters: inStock, platform, region, productType, deliveryType, search, ids (comma-separated, max 100).

Recommended: full sync once (no cursor), then every 5–15 minutes starting from the stored nextCursor, always with includeRemoved=true. A product with removed: true or inStock: false must not be sold.

POST /orders with externalId (your unique reference) and items (productId, qty 1–9, maxUnitPrice). For each line we check the live price: if it is above maxUnitPrice the whole order is rejected with PRICE_CHANGED and nothing is charged. If it is lower, you pay the lower price.

• Send an Idempotency-Key header (8–100 chars) and reuse it when you retry: you get the original response and are never charged twice. externalId is also unique per account.
• ?wait=N (0–25 s) waits for completion before answering. Without it the order is returned as processing and you are notified by webhook or by polling GET /orders/{id}.
• The total is debited when the order is accepted. Units that cannot be delivered are credited back automatically (refunded).

GET /orders/{id}/keys returns every delivered unit: value holds the code, the Steam Gift URL, the account credentials or the activation link depending on deliveryType. contentType is text/plain or an image type (then value is base64).

Store keys encrypted and show them only to the buyer. The first download of each order is logged on our side as delivery evidence.

Every delivered unit (key, Steam Gift link, account or activation link) is final: it is bought from the supplier for you at the moment of delivery and cannot be returned or refunded, even if it was not redeemed. Only units that could not be delivered are refunded, automatically. Check the region, activation.excludedCountries and deliveryType before selling, and show them to your customer.

If a delivered key does not work, contact [email protected] within 7 days with the order id and a screenshot of the activation error. The claim is forwarded to the supplier; a replacement or credit is only possible if the supplier replaces or refunds that key.

Set an https URL in Dashboard → Webhooks; you get a signing secret (whsec_…). Every event is a POST with headers X-BCK-Event, X-BCK-Delivery (unique id — de-duplicate on it) and X-BCK-Signature: t=<unix>,v1=<hex> where v1 = HMAC-SHA256(secret, t + "." + rawBody).

• Answer 2xx within 8 s and do the work asynchronously. Redirects are not followed.
• Failed deliveries are retried after 10 s, 30 s, 1 min, 5 min, 15 min, 30 min, 1 h, 2 h, 4 h, 6 h and 12 h (~26 h).
• Events may arrive out of order or more than once: always re-read GET /orders/{id} when in doubt.

Errors use HTTP status codes and a stable code. Quote requestId when contacting support.

GET /balance returns the balance of the key's mode. Top up from Dashboard → Balance: you receive a unique reference to include in the bank transfer; the amount is credited when it arrives (e-mail + balance.credited webhook). Every movement appears in the ledger.

Machine-readable docs: https://buycheapkeys.com/developers.md (this page as Markdown), https://buycheapkeys.com/developers.es.md (Spanish), the OpenAPI 3.1 spec https://buycheapkeys.com/partner-api/v1/openapi.json and https://buycheapkeys.com/llms.txt. Give these URLs to your AI assistant together with the prompt below.

Complete reference integration (Node.js 18+, no dependencies): https://buycheapkeys.com/developers/bck-partner-client.mjs — catalogue sync with cursor, safe ordering with retries and idempotency, key download and a webhook receiver with signature verification.

• Invariant 1 — sell only products with inStock=true and removed=false; re-sync every 5–15 min from the stored nextCursor.
• Invariant 2 — one customer order = one externalId = one Idempotency-Key; reuse both on every retry.
• Invariant 3 — always send maxUnitPrice; 4xx business errors are final and nothing was charged.
• Invariant 4 — retry only network errors, 429, 5xx and IDEMPOTENCY_IN_PROGRESS, with exponential backoff.
• Invariant 5 — an order in processing is already paid: wait for the webhook or poll GET /orders/{id}; never re-order.
• Invariant 6 — keep the API key server-side; verify webhook signatures; show customers the deliveryType and activation region.

• Keep API keys on your server only (never in browsers or apps) and in a secret manager / environment variables.
• Use separate keys per system and the minimum scopes; enable the IP allowlist.
• Always send maxUnitPrice and an Idempotency-Key.
• Verify every webhook signature and timestamp before trusting it.
• Rotate keys and the webhook secret if you suspect a leak, then revoke the old ones.