Connecting a wholesale supplier to your bot or store via API
Request signing, idempotency keys, webhooks and player checks: what a bot needs to sell without manual work.
If you sell through a Telegram bot, your own site or automatically on a marketplace, delivering codes by hand is a dead end. Connecting a wholesale supplier via API makes the sale fully automatic: the buyer pays, the goods are delivered. Here is what a reliable integration consists of, using the PacketUP HUB API as the example.
What the API does
GET /v1/products: the catalog at your prices, one line per denomination.GET /v1/balance: the balance, so the bot stops taking orders when funds run low.POST /v1/orders: an order for a code or a top-up by player ID.GET /v1/orders/{id}: the order status and delivered codes./v1/webhook: the address the platform sends order events to.
The full reference is in the API documentation and the OpenAPI specification.
Request signing
Every request is signed with the key’s secret using HMAC-SHA256: the headers carry the key (X-Api-Key), the time (X-Timestamp) and the signature (X-Signature). The secret never travels over the network, and an intercepted request can’t be replayed later. The docs have ready signing examples in curl, Python, Node.js, Go and PHP.
Keep the secret on your server only: never in client-side bot code or a public repository.
Idempotency keys: no double orders
The connection can drop just as the answer comes back, and the bot won’t know whether the order was placed. If it simply retries, the buyer gets two codes and you pay twice. So send every order with an Idempotency-Key header, such as the order number in your bot. A retry with the same key returns the same order instead of placing a new one.
Webhooks instead of polling
Top-ups and some codes aren’t instant. Instead of polling the status every second, set a webhook address: the platform sends order.completed, order.partially_completed, order.failed or order.review itself. Webhooks are signed; verify the signature before handing the goods to the buyer.
Checking the player
For ID top-ups a wrong ID costs money. Before ordering, have the buyer confirm the ID, and for games with servers the server or Zone ID too. More in the UID top-up guide.
Checklist before launch
- The key secret lives on the server, with only the permissions the bot needs.
- Every order goes out with a unique
Idempotency-Key. - The bot checks the balance and price before selling.
- The webhook signature is verified.
- You keep the codes on your side in case buyers ask.
API access opens in the dashboard once you join. Apply to get a key.