Build With Our API

How Authentication Works

Include your API key in the Authorization header of every request:

Authorization: Bearer a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6

Authentication Flow

1. 1 Generate your API key From the reseller dashboard: Profile → API Access → Generate API Key
2. 2 Include in requests Add the Authorization: Bearer header to every API call
3. 3 Server validates The server checks your key on every request for validity and GOLD plan status
4. 4 Invalid keys rejected Expired, revoked, or invalid keys receive a 401 Unauthorized response

1. 1 Log in to your Reseller Dashboard Navigate to https://www.x-institute.site/x/ and log in with your credentials.
2. 2 Open Profile Click the user icon in the top-right corner to open your profile modal.
3. 3 Generate API Key If you are on the GOLD plan, you will see an API Access section. Click "Generate API Key".
4. 4 Save Your Key Your API key is displayed only once. Copy and save it immediately. If lost, you must revoke and regenerate.
5. 5 Start Using It Include your API key in the Authorization header of all API requests.

{
  "status": "error",
  "code": 401,
  "message": "Human-readable error description",
  "data": null,
  "timestamp": "2026-05-13T15:00:00+06:30"
}

HTTP Status Codes

How It Works

1. Admin Ship or Cancel Order in the admin panel
2. Admin panel sends a POST to webhook sender with order data and your reseller_id
3. Webhook sender looks up your webhook_url and webhook_secret from the database
4. Webhook sender forwards the webhook to YOUR server
5. Your server receives the webhook, verifies the signature, and processes the order

Setting Up Your Webhook

1. 1 Create an endpoint On your server, create a URL that accepts POST requests (e.g., https://your-server.com/webhook-handler.php)
2. 2 Configure in Dashboard Go to Dashboard → Profile (👤) → Webhook Settings → Enter your URL → Save
3. 3 Get your secret A webhook_secret is auto-generated. Use it to verify incoming webhook signatures.

Webhook Payload

{
  "reseller_id": 12345,
  "order_id": "XIREAPIO123451746789012",
  "event": "shipped",
  "shipping_status": "Shipped",
  "customer_data": {
    "email": "[email protected]",
    "note": "My order note",
    "products": [
      {
        "name": "Spotify Premium 1 Year",
        "email": "[email protected]",
        "password": Password
      }
    ]
  }
}

Price Changes Payload

{
  "event": "price_changes"
}

Webhook Headers

Verifying Webhook Signatures

Use your webhook_secret to verify incoming webhooks are genuinely from X-Institute:

// webhook-handler.php — Your endpoint that receives webhooks

$rawPayload = file_get_contents('php://input');
$receivedSignature = $_SERVER['HTTP_X_WEBHOOK_SIGNATURE'] ?? '';
$webhookSecret = 'YOUR_WEBHOOK_SECRET'; // From dashboard

// Verify HMAC-SHA256 signature
$expectedSignature = hash_hmac('sha256', $rawPayload, $webhookSecret);

if (!hash_equals($expectedSignature, $receivedSignature)) {
    http_response_code(401);
    echo json_encode(['status' => 'error']);
    exit;
}

$data = json_decode($rawPayload, true);

switch ($data['event']) {
    case 'shipped':
        $orderId = $data['order_id'];
        $resellerId = $data['reseller_id'];
        $shippingStatus = $data['shipping_status'];
        $customerData = $data['customer_data'];
        $email = $customerData['email'];
        $note = $customerData['note'] ?? '';
        $products = $customerData['products'];
        // Update your system: mark order as shipped
        break;
    case 'cancelled':
        // Balance is auto-refunded by X-Institute
        break;
    case 'price_changes':
        // Update your local price catalog
        break;
}

http_response_code(200);
echo json_encode(['status' => 'success']);

Event Types

API Key Security

1. Never share your API key — treat it like a password
2. Store it securely — use environment variables, never hardcode in source
3. Use HTTPS only — all API requests must be over HTTPS
4. Rotate regularly — revoke and regenerate your key periodically
5. Revoke immediately if you suspect your key has been compromised

Best Practice Example

// ✅ GOOD: Store API key in environment variable
$apiKey = getenv('XINSTITUTE_API_KEY');

// ❌ BAD: Never hardcode your API key
$apiKey = 'a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6'; // DANGEROUS!

PHP

$apiKey = getenv('XINSTITUTE_API_KEY');
$baseUrl = 'https://v1.x-institute.site';

// Fetch products
$ch = curl_init($baseUrl . '/products');
curl_setopt($ch, CURLOPT_HTTPHEADER, [
    'Authorization: Bearer ' . $apiKey,
    'Accept: application/json'
]);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
$response = curl_exec($ch);
curl_close($ch);

$products = json_decode($response, true);
print_r($products);

Python

import os
import requests

API_KEY = os.environ.get('XINSTITUTE_API_KEY')
BASE_URL = 'https://v1.x-institute.site'

headers = {
    'Authorization': f'Bearer {API_KEY}',
    'Accept': 'application/json'
}

# Fetch products
response = requests.get(f'{BASE_URL}/products', headers=headers)
products = response.json()
print(products)

# Submit an order
order_data = {
    'customer_email': '[email protected]',
    'note': 'My order note',
    'products': [
        {'product_id': 'SPOTIFY_1Y', 'quantity': 1}
    ]
}
response = requests.post(f'{BASE_URL}/order', json=order_data, headers=headers)
print(response.json())

JavaScript (Node.js)

const API_KEY = process.env.XINSTITUTE_API_KEY;
const BASE_URL = 'https://v1.x-institute.site';

// Fetch products
const response = await fetch(BASE_URL + '/products', {
    headers: {
        'Authorization': 'Bearer ' + API_KEY,
        'Accept': 'application/json'
    }
});
const products = await response.json();
console.log(products);

// Submit an order
const orderResponse = await fetch(BASE_URL + '/order', {
    method: 'POST',
    headers: {
        'Authorization': 'Bearer ' + API_KEY,
        'Content-Type': 'application/json'
    },
    body: JSON.stringify({
        customer_email: '[email protected]',
        note: 'My order note',
        products: [{ product_id: 'SPOTIFY_1Y', quantity: 1 }]
    })
});
const order = await orderResponse.json();
console.log(order);