REST API documentation.

Authentication

All API requests require an API key sent in the Authorization header. Create keys in Settings → Developer in your dashboard.

curl -H "Authorization: Bearer sk_live_your_key_here" \
  https://your-store.cartico.com/api/v1/products

Rate limits

60 requests per minute per API key. If you exceed the limit, you'll receive a 429 response with a Retry-After header.

Pagination

List endpoints support limit (max 250) and offset query parameters. The response includes total count, limit, and offset.

GET /api/v1/products?limit=25&offset=50

// Response
{
  "products": [...],
  "total": 142,
  "limit": 25,
  "offset": 50
}

Endpoints

Errors

The API returns standard HTTP status codes with JSON error messages.

Webhooks

Receive real-time notifications when events happen in your store. Create webhook endpoints in Settings → Developer.

Supported events

Verification

All webhook deliveries include an X-Cartico-Signature header with an HMAC-SHA256 signature. Verify the signature using the secret shown when the webhook is created.

// Verify webhook signature (Node.js)
import crypto from "crypto";

function verifySignature(payload, signature, secret) {
  const expected = crypto
    .createHmac("sha256", secret)
    .update(payload)
    .digest("hex");
  return crypto.timingSafeEqual(
    Buffer.from(signature),
    Buffer.from(expected)
  );
}