One REST API for your store's catalog, inventory, and orders — with a full test mode to build against safely, signed webhooks for every event, and a product feed that lists you on TikTok, Meta, and Google. Per-tenant scoped keys, and card data never touches our servers.
# read your live catalog curl https://app.batchly.shop/api/products \ -H "Authorization: Bearer bly_live_…" # -> storefront-safe fields only, never cost { "products": [ { "sku":"CB-04", "name":"Cold Brew 4-Pack", "price":30, "quantity":4 } ] }
Create a key in Developers inside Batchly, pick a mode and scopes, and you’re selling through the API. The same endpoints power our own WooCommerce plugin.
# adjust stock (needs inventory:write) curl -X PATCH .../api/products/BD-35 \ -H "Authorization: Bearer bly_live_…" \ -d '{"quantity": 12}' # record an online order (idempotent) curl -X POST .../api/orders \ -H "Authorization: Bearer bly_live_…" \ -d '{"sku":"BD-35","quantity":1, "externalRef":"web-1042-1"}' # re-send the same ref -> {"deduped": true}
Flip a key to Test and you get a bly_test_ credential. It reads your live catalog, but every write is sandboxed — test orders are tagged, inventory writes never change live stock, and none of it hits your books, reports, reconciliation, or webhooks. Build safely, then swap in bly_live_ and keep a test key around forever.
# a test key never changes live stock curl -X PATCH .../api/products/BD-35 \ -H "Authorization: Bearer bly_test_…" \ -d '{"quantity": 0}' -> {"ok":true,"test":true,"applied":false} # a test order is recorded, but sandboxed curl -X POST .../api/orders \ -H "Authorization: Bearer bly_test_…" \ -d '{"sku":"BD-35","quantity":1}' -> {"ok":true,"test":true} # not in your books
Bearer-authenticated REST over JSON. Keys are per-store and scoped; the base is https://app.batchly.shop/api.
Point a webhook at Zapier, Make, n8n, or your own endpoint and Batchly pushes events as they happen — each delivery HMAC-signed, retried with backoff, and logged. Test-mode events never reach a live endpoint.
const expected = 'sha256=' + crypto .createHmac('sha256', SECRET) .update(rawBody).digest('hex'); const ok = crypto.timingSafeEqual( Buffer.from(req.headers['x-batchly-signature']), Buffer.from(expected) ); // ok === true -> trust the payload
A live catalog feed in the standard shopping format (RSS/XML + CSV). Point any channel at the URL and your products appear there, kept in step automatically. Storefront-safe fields only — never cost or margin.
Add the feed URL in Seller Center and TikTok pulls your live catalog.
A data source in Commerce/Catalog Manager — one feed, both surfaces.
Scheduled fetch of the XML URL for Google Merchant and Pinterest catalogs.
The API is designed for security-conscious retail: least privilege, tenant isolation, and no card data on our servers.
Only a SHA-256 hash of a key is stored; the raw value is shown once. Every key is per-store and scope-limited.
The API resolves the store from the key and fences every read and write to that tenant — enforced in the database.
The API only sees amounts and transaction IDs. Cards are read on the terminal and settled by the gateway.
Order totals are computed from your own catalog — a client can never post a forged amount into your books.
A stable externalRef makes retries safe; a re-fired webhook or dropped connection can’t double a sale.
Deliveries only reach public HTTPS endpoints — internal and loopback targets are refused.
Sign in, open Developers, and create a test key. Build against production safely, then flip to live. Need something custom? Our team will build the integration for you.