⌁
API key
48 alphanumeric characters. The key remains available under My account until you regenerate it.
01
ACCESS
Authentication
Every API request requires your personal key in the X-API-Key header. Keep it private and use it only from your backend.
◇
Server-side only
Never expose the key in frontend code, mobile apps or public repositories.
Request header
X-API-Key: YOUR_API_KEY02
FIRST REQUEST
Quick start
Request the live catalog in seconds. Replace the placeholder with your API key.
curl "https://api.goribucshop.com/api/v1/catalog" \
-H "X-API-Key: YOUR_API_KEY"import requests
response = requests.get(
"https://api.goribucshop.com/api/v1/catalog",
headers={"X-API-Key": "YOUR_API_KEY"},
timeout=15,
)
response.raise_for_status()
print(response.json())GET
/api/v1/catalogReturns products, prices and live availability.
Response
idintegerProduct identifier.
denominationintegerProduct value.
price_usdstringUnit price in USD.
availableintegerQuantity currently available.
200 OK
[
{
"id": 12,
"game": "PUBG Mobile",
"product": "UC Code",
"denomination": 660,
"price_usd": "9.950",
"available": 84
}
]GET
/api/v1/profileReturns account details and available balance.
Use this endpoint to
- Display the current balance
- Confirm account identity
- Read the masked API key hint
200 OK
{
"telegram_id": 123456789,
"username": "username",
"language": "en",
"balance_usd": "250.000",
"api_key_hint": "Ab12••••Xy90"
}POST
/api/v1/ordersCreates one idempotent order and returns delivered codes.
Idempotency required
Send a unique Idempotency-Key for every checkout attempt. Retrying the same request is safe and will not create a duplicate charge.
Headers
X-API-KeyrequiredYour private API key.
Idempotency-KeyrequiredUnique value, 8–100 characters.
JSON body
product_idintegerProduct ID from the catalog.
quantity1…10000Requested quantity.
Request
curl -X POST \
"https://api.goribucshop.com/api/v1/orders" \
-H "X-API-Key: YOUR_API_KEY" \
-H "Idempotency-Key: checkout-8f31a2c4" \
-H "Content-Type: application/json" \
-d '{"product_id":12,"quantity":2}'200 OK
{
"order_id": "ORD-8F31A2C4", "denomination": 660, "quantity": 2,
"unit_price_usd": "9.950", "total_price_usd": "19.900",
"codes": ["CODE-ONE", "CODE-TWO"], "balance_usd": "230.100"
}GET
/api/v1/ordersReturns the authenticated account’s order history.
Authenticate→Request history→Receive orders
POST
/api/v1/api-key/rotateInvalidates the current key and issues a new one.
Update integrations
The new key remains available under My account. The previous key stops working immediately.
03
REFERENCE
Error handling
StatusMeaningAction
400Invalid request or quantityValidate parameters
401Missing or invalid API keyCheck authentication
402Insufficient balanceAdd funds and retry
409Idempotency conflictUse a new unique key
422Product unavailableRefresh the catalog
04
GOOD PRACTICE
Security checklist
Treat your API key like a password. Rotate it immediately if it may have been exposed.
- Keep credentials in environment variables or a secret manager
- Use a new idempotency key for each checkout
- Set request timeouts and log order IDs
- Never publish delivered codes in application logs