Руководство по API

Документация API ведётся на английском языке — так же, как справочник на /developers: названия полей, коды ошибок и примеры кода не переводятся, чтобы не расходиться с реальными ответами API. Вопросы на русском можно задать в поддержку: support@arcadezy.com или @olovpay_support.

Arcadezy Reseller API — Integration Guide

Version 1 · Base URL https://arcadezy.com/api/v1 · Updated 2026-09-22

This guide walks you from zero to a working integration. For the endpoint reference with live examples, see https://arcadezy.com/developers.

---

1. Before you start

What the API lets you do: browse the catalog, check a game account ID, place orders, track their status, and receive webhooks when they finish. Everything is paid from your Arcadezy balance — the API never asks for card or crypto details.

Two prerequisites:

1. A funded balance. Top up at https://arcadezy.com/account/wallet (USDT on BEP-20 or TON, minimum $5). Orders fail with INSUFFICIENT_FUNDS if the balance is short.
2. An API key. Cabinet → Settings → API keys → Create key. The key is shown once — store it in your server's environment, never in client-side code or a public repository. Up to 3 active keys; revoke and recreate freely.

One price for everyone. Since 22 September 2026 there are no pricing tiers and no subscription: every key returns the same prices as the site. You do not pass any tier parameter.

---

2. Authentication

Send your key in the X-API-Key header on every request:

curl https://arcadezy.com/api/v1/balance \
  -H "X-API-Key: ak_your_key_here"

There are no other auth schemes — no OAuth, no session cookies.

Response format. Every response is JSON:

// success
{ "ok": true,  "balance_usd": "125.40" }

// failure
{ "ok": false, "code": "INSUFFICIENT_FUNDS", "error": "Not enough balance" }

Always branch on ok (or on the HTTP status), then read code for machine-readable handling and error for a human-readable message.

Rate limits: 120 requests/minute per key, 300/minute per IP before authentication, and a stricter 20/minute for validate-id (it calls our supplier). Exceeding a limit returns 429 RATE_LIMITED with a Retry-After header — wait that many seconds, then retry.

---

3. Quickstart: your first order in four calls

Step 1 — check your balance

curl https://arcadezy.com/api/v1/balance -H "X-API-Key: $KEY"

{ "ok": true, "balance_usd": "125.40" }

Step 2 — find the product

curl "https://arcadezy.com/api/v1/categories?type=topup&q=mobile%20legends" \
  -H "X-API-Key: $KEY"

Query parameters: type (topup, giftcard, gamekey, telegram, steam), q (search text), page, sort (az, lo, hi).

Each item carries a slug — use it in the next call.

Step 3 — list the packages (offers)

curl https://arcadezy.com/api/v1/categories/mobile-legends-global/offers \
  -H "X-API-Key: $KEY"

The response contains the offers with the price (the same for every key) and, for top-ups, the fields the game requires (for example player_id and server_id). Take the id (a UUID) of the offer you want.

Step 4 — place the order

curl -X POST https://arcadezy.com/api/v1/orders \
  -H "X-API-Key: $KEY" \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: $(uuidgen)" \
  -d '{
        "offer_id": "0f0c1d2e-3a4b-5c6d-7e8f-901234567890",
        "qty": 1,
        "fields": { "player_id": "648095225", "server_id": "8572" }
      }'

201 Created:

{
  "ok": true,
  "order": {
    "id": "8b1f...",
    "status": "paid",
    "total_usd": "0.89",
    "qty": 1,
    "category": "mobile-legends-global",
    "offer": "86 Diamonds"
  },
  "idempotent_replay": false
}

The balance is charged immediately and the order goes to our supplier. Delivery normally completes within 1–5 minutes.

---

4. Idempotency — read this before going live

Network timeouts happen. If you retry a request without protection, you can pay twice for one order.

Always send an Idempotency-Key header on POST /orders — a unique string (a UUID) that you generate per logical order and reuse when retrying:

• First call with that key → order is created, 201, idempotent_replay: false.
• Repeat with the same key and the same body → the original order is returned, 200, idempotent_replay: true. No second charge.
• Same key with a different body → 409 IDEMPOTENCY_CONFLICT. Generate a new key for a genuinely new order.

Recommended pattern: store the key in your database next to your own order record before calling us, and reuse it on every retry for that record.

---

5. Tracking orders

Poll a single order

curl https://arcadezy.com/api/v1/orders/8b1f... -H "X-API-Key: $KEY"

{
  "ok": true,
  "order": {
    "id": "8b1f...",
    "status": "completed",
    "total_usd": "0.89",
    "qty": 1,
    "category": "mobile-legends-global",
    "offer": "86 Diamonds",
    "fail_reason": null,
    "created_at": "2026-08-18T09:12:31.000Z",
    "completed_at": "2026-08-18T09:13:44.000Z",
    "codes": []
  }
}

For gift cards and game keys, codes[] contains the activation codes once the status is completed (it is empty in every other state).

Order statuses

Polling etiquette: poll every 10–15 seconds for the first two minutes, then back off. Better: use webhooks and stop polling entirely.

List recent orders

curl "https://arcadezy.com/api/v1/orders?limit=20" -H "X-API-Key: $KEY"

---

6. Webhooks — get notified instead of polling

Register your endpoint

curl -X PUT https://arcadezy.com/api/v1/webhook \
  -H "X-API-Key: $KEY" \
  -H "Content-Type: application/json" \
  -d '{"url": "https://yourshop.example.com/arcadezy-hook"}'

The response contains a signing secret, shown only once — store it.

URL requirements: public HTTPS on port 443, no credentials in the URL, no private/internal addresses (we resolve DNS and block internal ranges).

What you receive

POST with a JSON body and two headers:

X-Arcadezy-Signature: <hex hmac>
X-Arcadezy-Timestamp: <unix seconds>

{
  "event": "order.completed",
  "order": {
    "id": "8b1f...",
    "status": "completed",
    "total_usd": "0.89",
    "qty": 1,
    "fail_reason": null,
    "completed_at": "2026-08-18T09:13:44.000Z"
  }
}

Events: order.completed, order.failed.

Verify the signature — mandatory

The signature is HMAC-SHA256(secret, "<timestamp>.<raw body>") in hex. Verify it on the raw request body, before JSON parsing:

import crypto from "node:crypto";

function verify(rawBody, timestamp, signature, secret) {
  const expected = crypto
    .createHmac("sha256", secret)
    .update(`${timestamp}.${rawBody}`)
    .digest("hex");
  const a = Buffer.from(expected);
  const b = Buffer.from(signature);
  return a.length === b.length && crypto.timingSafeEqual(a, b);
}

import hmac, hashlib

def verify(raw_body: bytes, timestamp: str, signature: str, secret: str) -> bool:
    expected = hmac.new(
        secret.encode(), f"{timestamp}.".encode() + raw_body, hashlib.sha256
    ).hexdigest()
    return hmac.compare_digest(expected, signature)

Also reject requests whose timestamp is more than ~5 minutes old (replay protection).

Delivery behaviour

Respond 2xx quickly (under 5 seconds) — do the heavy work asynchronously. Non-2xx or timeout is retried a few times with backoff. After 10 consecutive failures the webhook is disabled automatically and you must re-register it. Send a test delivery any time:

curl -X POST https://arcadezy.com/api/v1/webhook -H "X-API-Key: $KEY"

Treat webhooks as at-least-once: the same event may arrive twice, so make your handler idempotent (key on order.id + event).

---

7. Validating a game ID before ordering

For supported games you can check that the account exists — and show its nickname — before taking money from your customer:

curl -X POST https://arcadezy.com/api/v1/categories/mobile-legends-global/validate-id \
  -H "X-API-Key: $KEY" \
  -H "Content-Type: application/json" \
  -d '{"fields": {"player_id": "648095225", "server_id": "8572"}}'

{ "ok": true, "supported": true, "valid": true, "player_name": "Olovpay", "region": "Uzbekistan" }

How to read the answer:

• supported: false → this game has no ID check. Proceed with the order.
• valid: false → the ID is wrong. Ask your customer to correct it.
• HTTP 503 SUPPLIER_UNAVAILABLE → the check is temporarily unavailable. Do not treat this as a valid ID — retry later or warn the customer.

Limits: 20 checks/minute per key; repeated checks of the same ID are served from a 10-minute cache (they do not count against the supplier).

---

8. Error codes

Retry 429 and 503 with exponential backoff. Never blind-retry 409 or 422 — fix the request first.

---

9. Going live — checklist

• Key stored server-side only (environment variable / secret manager)
• Idempotency-Key sent on every order, persisted with your order record
• Webhook endpoint live over HTTPS, signature verified, handler idempotent
• Balance monitored, with an alert before it runs out
• failed orders handled (money returns to balance — decide whether you retry automatically or refund your customer)
• Errors logged with code so you can distinguish "retry" from "fix"
• For top-ups: game ID validated before charging your customer

---

10. Support

• E-mail: support@arcadezy.com
• Telegram: @olovpay_support
• News & reseller channel: @arcadezy_resell

When reporting an API problem, include the order id (or the Idempotency-Key), the endpoint, the response code, and the approximate time in UTC.