API v1

Reseller API

Programmatic access to the Arcadezy catalog and orders: browse offers at your prices, create orders paid from your balance, follow their status and collect delivered codes.

Getting started

Base URL: https://arcadezy.com/api/v1
Authentication: Create a key in Account → Settings → API keys and send it in the X-API-Key header.
Rate limit: 120 requests per minute per key.
Responses: Always JSON: { ok: true, ... } or { ok: false, code, error }.

Account

Check what you can spend before you order.

GET/api/v1/balance

Your wallet balance.

curl https://arcadezy.com/api/v1/balance -H "X-API-Key: ak_..."

Catalog

Browse categories and offers at the prices that apply to your account.

GET/api/v1/categories?type=topup&q=&page=1&sort=lo

Catalog. type: topup | giftcard | gamekey | telegram | steam. Paginated, 48 per page.

curl "https://arcadezy.com/api/v1/categories?type=topup" -H "X-API-Key: ak_..."

GET/api/v1/categories/{slug}/offers

Offers with your prices (retail, or your reseller plan) and the fields required to place an order.

curl https://arcadezy.com/api/v1/categories/mobile-legends-global/offers -H "X-API-Key: ak_..."

POST/api/v1/categories/{slug}/validate-id

Check a game ID before ordering: whether the account exists and whose it is. supported=false means the game has no check (not that the ID is wrong); 503 means our supplier is temporarily unreachable — do not treat it as a valid ID. Limit: 20 checks per minute per key; repeated checks of the same ID are served from cache.

curl -X POST https://arcadezy.com/api/v1/categories/mobile-legends-global/validate-id \
  -H "X-API-Key: ak_..." -H "Content-Type: application/json" \
  -d '{"fields":{"player_id":"123456789","server_id":"1234"}}'

Orders

Create orders paid from your balance, then poll their status and collect codes.

POST/api/v1/orders

Create an order, paid from your balance. The Idempotency-Key header is required — retrying with the same key returns the same order instead of charging you twice.

curl -X POST https://arcadezy.com/api/v1/orders \
  -H "X-API-Key: ak_..." \
  -H "Idempotency-Key: your-unique-id-123" \
  -H "Content-Type: application/json" \
  -d '{"offer_id":"<uuid from /offers>","fields":{"player_id":"123456789","server_id":"1234"}}'

GET/api/v1/orders?limit=20

Recent orders.

curl https://arcadezy.com/api/v1/orders -H "X-API-Key: ak_..."

GET/api/v1/orders/{id}

Order status. For completed gift cards and game keys the response also includes codes[].

curl https://arcadezy.com/api/v1/orders/<order-id> -H "X-API-Key: ak_..."

Webhooks

Let us push order events to you instead of polling for them.

PUT/api/v1/webhook

Subscribe to order events — we POST to your URL instead of you polling. Returns the signing secret once. Events: order.completed, order.failed. The URL must be public https on port 443 (private and loopback addresses are rejected, DNS is re-checked before every delivery). Delivery: 5 second timeout, up to 3 attempts with backoff.

curl -X PUT https://arcadezy.com/api/v1/webhook \
  -H "X-API-Key: ak_..." -H "Content-Type: application/json" \
  -d '{"url":"https://your-shop.com/arcadezy-hook"}'

GET/api/v1/webhook

Current subscription: url, enabled, consecutive failures, last error. After 10 consecutive failures delivery turns itself off.

curl https://arcadezy.com/api/v1/webhook -H "X-API-Key: ak_..."

POST/api/v1/webhook

Send a test event to your URL and report whether it was delivered.

curl -X POST https://arcadezy.com/api/v1/webhook -H "X-API-Key: ak_..."

DELETE/api/v1/webhook

Stop delivery.

curl -X DELETE https://arcadezy.com/api/v1/webhook -H "X-API-Key: ak_..."

Webhook signature

Verify every delivery before you trust the payload.

Each webhook carries X-Arcadezy-Signature and X-Arcadezy-Timestamp. The signature is hex(HMAC-SHA256(secret, `{timestamp}.{raw_body}`)). Reject requests whose timestamp is older than about five minutes to prevent replay.

// Node.js
const expected = crypto.createHmac("sha256", SECRET)
  .update(`${req.headers["x-arcadezy-timestamp"]}.${rawBody}`)
  .digest("hex");
const ok = crypto.timingSafeEqual(
  Buffer.from(expected), Buffer.from(req.headers["x-arcadezy-signature"]));

Error codes

Failed requests answer with an HTTP status and a stable code in the body.

401UNAUTHORIZED

The key is missing, revoked or wrong.

402INSUFFICIENT_BALANCE

Top up the wallet and retry.

403EMAIL_NOT_VERIFIED

Confirm the account email first.

404NOT_FOUND

No such category, offer or order.

409OUT_OF_STOCKIDEMPOTENCY_CONFLICT

The offer ran out, or the same Idempotency-Key was reused with a different body.

422VALIDATIONFIELDS_INVALIDQTY_INVALID

The request body is malformed, or the order fields do not match the offer.

429RATE_LIMITEDDAILY_LIMIT

Too many requests — slow down and retry later.

503SUPPLIER_UNAVAILABLE

Our supplier is temporarily unreachable. Retry; do not assume the order failed.