API Documentation

curl https://sellmycode.net/api

curl https://sellmycode.net/api/account/details \
  -H "Authorization: Bearer YOUR_API_KEY"

curl https://sellmycode.net/api/account/details \
  -H "X-Api-Key: YOUR_API_KEY"

{
  "status": "error",
  "msg": "Invalid request"
}

curl https://sellmycode.net/api/account/details \
  -H "Authorization: Bearer YOUR_API_KEY"

curl https://sellmycode.net/api/items/all \
  -H "Authorization: Bearer YOUR_API_KEY"

curl "https://sellmycode.net/api/items/item?item_id=123" \
  -H "Authorization: Bearer YOUR_API_KEY"

curl "https://sellmycode.net/api/sales?from=2026-01-01&status=active&per_page=25" \
  -H "Authorization: Bearer YOUR_API_KEY"

{
  "status": "success",
  "pagination": { "page": 1, "per_page": 25, "total": 132, "last_page": 6 },
  "sales": [
    {
      "id": 981,
      "purchase_code": "8f14e45f-ce95-41d8-a2b6-72e5f13d81a7",
      "item": { "id": 123, "name": "My Theme" },
      "buyer": "johndoe",
      "license_type": "Regular",
      "price": 29.0,
      "fee": 5.8,
      "earning": 23.2,
      "currency": "USD",
      "sale_status": "active",
      "cleared": true,
      "date": "2026-07-01T09:30:00+00:00"
    }
  ]
}

curl "https://sellmycode.net/api/purchases?status=active" \
  -H "Authorization: Bearer YOUR_API_KEY"

{
  "status": "success",
  "pagination": { "page": 1, "per_page": 25, "total": 3, "last_page": 1 },
  "purchases": [
    {
      "purchase_code": "8f14e45f-ce95-41d8-a2b6-72e5f13d81a7",
      "item": { "id": 123, "name": "My Theme", "url": "https://sellmycode.net/item/my-theme/123" },
      "license_type": "Regular",
      "price": 29.0,
      "currency": "USD",
      "purchase_status": "active",
      "download_expiry_at": "2027-01-01T00:00:00+00:00",
      "download_expired": false,
      "date": "2026-07-01T09:30:00+00:00"
    }
  ]
}

curl "https://sellmycode.net/api/balance?statements=1&wallet=balance" \
  -H "Authorization: Bearer YOUR_API_KEY"

{
  "status": "success",
  "currency": "USD",
  "wallets": {
    "balance": 1250.75,
    "pending_balance": 89.4,
    "store_credit": 12.5
  },
  "pagination": { "page": 1, "per_page": 25, "total": 57, "last_page": 3 },
  "statements": [
    {
      "id": 4021,
      "title": "[Sale] #981 (My Theme)",
      "wallet": "balance",
      "type": "credit",
      "amount": 29.0,
      "total": 23.2,
      "date": "2026-07-01T09:30:05+00:00"
    }
  ]
}

curl -X POST https://sellmycode.net/api/purchases/validation \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -d "purchase_code=BUYER_PURCHASE_CODE"

// license check from your app / plugin
$ch = curl_init('https://sellmycode.net/api/purchases/validation');
curl_setopt_array($ch, [
    CURLOPT_POST => true,
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => ['Authorization: Bearer YOUR_API_KEY'],
    CURLOPT_POSTFIELDS => http_build_query(['purchase_code' => $code]),
]);
$res = json_decode(curl_exec($ch), true);
$valid = ($res['status'] ?? '') === 'success';

// Node.js 18+ (built-in fetch)
const res = await fetch('https://sellmycode.net/api/purchases/validation', {
  method: 'POST',
  headers: {
    'Authorization': 'Bearer YOUR_API_KEY',
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({ purchase_code: code }),
});
const data = await res.json();
const valid = res.ok && data.status === 'success';

# Python 3 + requests
import requests

res = requests.post(
    'https://sellmycode.net/api/purchases/validation',
    headers={'Authorization': 'Bearer YOUR_API_KEY'},
    data={'purchase_code': code},
    timeout=10,
)
valid = res.status_code == 200 and res.json().get('status') == 'success'

{
  "status": "success",
  "buyer": "johndoe",
  "item": {
    "purchase_code": "8f14e45f-ce95-41d8-a2b6-72e5f13d81a7",
    "license_type": "Regular",
    "price": 29.0,
    "currency": "USD",
    "item": { "…item fields…" },
    "supported_until": "2026-12-01T00:00:00+00:00",
    "download_expiry": "2026-08-01T00:00:00+00:00",
    "downloaded": true,
    "date": "2026-07-01T09:30:00+00:00"
  }
}

curl "https://sellmycode.net/api/catalog/items?search=woocommerce&sort=popular" \
  -H "Authorization: Bearer YOUR_API_KEY"

{
  "status": "success",
  "pagination": { "page": 1, "per_page": 25, "total": 64, "last_page": 3 },
  "items": [
    {
      "id": 123,
      "name": "My Theme",
      "url": "https://sellmycode.net/item/my-theme/123",
      "thumbnail": "https://sellmycode.net/files/thumbnails/…",
      "category": { "id": 4, "name": "WordPress", "slug": "wordpress" },
      "author": "janedoe",
      "price": { "regular": 29.0, "extended": 145.0 },
      "currency": "USD",
      "rating": { "average": 4.8, "count": 36 },
      "version": "2.1.0",
      "updated_at": "2026-07-10T08:00:00+00:00",
      "published_at": "2026-01-05T12:00:00+00:00"
    }
  ]
}

curl https://sellmycode.net/api/catalog/items/123 \
  -H "Authorization: Bearer YOUR_API_KEY"

{
  "status": "success",
  "categories": [
    { "id": 4, "name": "WordPress", "slug": "wordpress", "url": "https://sellmycode.net/categories/wordpress", "items_count": 128 }
  ]
}

curl "https://sellmycode.net/api/license/activate" \
  -H "Content-Type: application/json" \
  -d '{"purchase_code":"d71c21a3-...","domain":"customer-site.com"}'

{
  "status": "success",
  "code": "activated",
  "domain": "customer-site.com",
  "license_type": "Regular",
  "activation_limit": 2,
  "activations_used": 1,
  "updates": { "active": true, "until": "2027-01-30T10:00:00+00:00" }
}

curl "https://sellmycode.net/api/updates/check" \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"packages":[{"slug":"my-theme","type":"theme","version":"1.4.0"}]}'

{
  "status": "success",
  "checked": 1,
  "updates": [
    {
      "item_id": 123,
      "slug": "my-theme",
      "type": "theme",
      "name": "My Theme",
      "installed_version": "1.4.0",
      "new_version": "1.6.2",
      "changelog": { "version": "1.6.2", "body": "Fixed ..." },
      "can_download": true,
      "reason": null,
      "update_window_ends_at": "2027-01-30T10:00:00+00:00",
      "download_url": "https://sellmycode.net/api/updates/download/123",
      "renew_url": null
    }
  ]
}

curl -L -o update.zip "https://sellmycode.net/api/updates/download/123" \
  -H "Authorization: Bearer YOUR_API_KEY"

{
  "id": "1c2f6a7e-9d31-4c3e-8f5b-2d9f8f4f1a10",
  "event": "sale.created",
  "created_at": "2026-07-18T10:30:00+00:00",
  "data": {
    "sale_id": 981,
    "purchase_code": "8f14e45f-ce95-41d8-a2b6-72e5f13d81a7",
    "type": "item",
    "item": { "id": 123, "name": "My Theme" },
    "buyer": "johndoe",
    "license_type": "Regular",
    "price": 29.0,
    "earning": 23.2,
    "currency": "USD",
    "date": "2026-07-18T10:30:00+00:00"
  }
}

$secret  = 'whsec_...'; // from Settings → API Key → Webhooks
$body    = file_get_contents('php://input');
$header  = $_SERVER['HTTP_X_SMC_SIGNATURE'] ?? '';

parse_str(str_replace(',', '&', $header), $sig); // ['t' => ..., 'v1' => ...]

$expected = hash_hmac('sha256', $sig['t'] . '.' . $body, $secret);

if (!hash_equals($expected, $sig['v1'] ?? '') || abs(time() - (int) $sig['t']) > 300) {
    http_response_code(400); exit;
}

http_response_code(200); // ack fast, process async

// Express: use express.raw() so the RAW body is available for the HMAC
const crypto = require('crypto');
const SECRET = 'whsec_...'; // from Settings → API Key → Webhooks

app.post('/webhooks/sellmycode', express.raw({ type: 'application/json' }), (req, res) => {
  const header = req.get('X-SMC-Signature') || '';
  const sig = Object.fromEntries(header.split(',').map(p => p.split('=')));

  const expected = crypto.createHmac('sha256', SECRET)
    .update(sig.t + '.' + req.body.toString('utf8')).digest('hex');

  const fresh = Math.abs(Date.now() / 1000 - Number(sig.t)) < 300;
  const valid = sig.v1 &&
    crypto.timingSafeEqual(Buffer.from(expected), Buffer.from(sig.v1));

  if (!valid || !fresh) return res.sendStatus(400);

  const event = JSON.parse(req.body); // { id, event, created_at, data }
  res.sendStatus(200); // ack fast, process async
});

# Flask — request.get_data() is the RAW body needed for the HMAC
import hmac, hashlib, time
from flask import Flask, request

SECRET = 'whsec_...'  # from Settings → API Key → Webhooks

@app.route('/webhooks/sellmycode', methods=['POST'])
def webhook():
    header = request.headers.get('X-SMC-Signature', '')
    sig = dict(p.split('=', 1) for p in header.split(',') if '=' in p)

    body = request.get_data()  # bytes, unparsed
    expected = hmac.new(
        SECRET.encode(), (sig.get('t', '') + '.').encode() + body, hashlib.sha256
    ).hexdigest()

    fresh = abs(time.time() - float(sig.get('t', 0))) < 300
    if not (hmac.compare_digest(expected, sig.get('v1', '')) and fresh):
        return '', 400

    event = request.get_json()  # { id, event, created_at, data }
    return '', 200  # ack fast, process async

# Rails / Rack — request.body.read is the RAW body needed for the HMAC
SECRET = 'whsec_...' # from Settings → API Key → Webhooks

def webhook
  header = request.headers['X-SMC-Signature'].to_s
  sig = header.split(',').to_h { |p| p.split('=', 2) }

  body = request.body.read
  expected = OpenSSL::HMAC.hexdigest('SHA256', SECRET, "#{sig['t']}.#{body}")

  fresh = (Time.now.to_i - sig['t'].to_i).abs < 300
  valid = sig['v1'] &&
    ActiveSupport::SecurityUtils.secure_compare(expected, sig['v1'])

  return head :bad_request unless valid && fresh

  event = JSON.parse(body) # { id, event, created_at, data }
  head :ok # ack fast, process async
end