Build With Our API

How Authentication Works

Include your API key in the Authorization header of every request:

Authorization: Bearer a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6

Authentication Flow

1. 1 Generate your API key From the reseller dashboard: Profile → API Access → Generate API Key
2. 2 Include in requests Add the Authorization: Bearer header to every API call
3. 3 Server validates The server checks your key on every request for validity and GOLD plan status
4. 4 Invalid keys rejected Expired, revoked, or invalid keys receive a 401 Unauthorized response

1. 1 Log in to your Reseller Dashboard Navigate to https://www.x-institute.site/x/ and log in with your credentials.
2. 2 Open Profile Click the user icon in the top-right corner to open your profile modal.
3. 3 Generate API Key If you are on the GOLD plan, you will see an API Access section. Click "Generate API Key".
4. 4 Save Your Key ⚠️ Your API key is displayed only once. Copy and save it immediately. If lost, you must revoke and regenerate.
5. 5 Start Using It Include your API key in the Authorization header of all API requests.

{
  "status": "error",
  "code": 401,
  "message": "Human-readable error description",
  "data": null,
  "timestamp": "2026-05-13T15:00:00+06:30"
}

HTTP Status Codes

How It Works

1. Admin clicks "Ship" in the admin panel
2. Admin panel sends a POST to webhook/request.php with order data and your reseller_id
3. webhook/request.php looks up your webhook_url and webhook_secret from the database
4. webhook/request.php forwards the webhook to YOUR server
5. Your server receives the webhook, verifies the signature, and processes the order

Setting Up Your Webhook

1. 1 Create an endpoint On your server, create a URL that accepts POST requests (e.g., https://your-server.com/webhook-handler.php)
2. 2 Configure in Dashboard Go to Dashboard → Profile (👤) → Webhook Settings → Enter your URL → Save
3. 3 Get your secret A webhook_secret is auto-generated. Use it to verify incoming webhook signatures.

Webhook Payload

{
  "event": "shipped",
  "order_id": "XIREO123451746789012",
  "timestamp": "2026-05-13T15:00:00+06:30",
  "data": {
    "tracking_info": "TRACK123456",
    "shipping_status": "In Transit",
    "customer_data": {
      "email": "[email protected]"
    }
  }
}

Webhook Headers

Verifying Webhook Signatures

Use your webhook_secret to verify incoming webhooks are genuinely from X-Institute:

// webhook-handler.php — Your endpoint that receives webhooks

$rawPayload = file_get_contents('php://input');
$receivedSignature = $_SERVER['HTTP_X_WEBHOOK_SIGNATURE'] ?? '';
$webhookSecret = 'YOUR_WEBHOOK_SECRET'; // From dashboard

// Verify HMAC-SHA256 signature
$expectedSignature = hash_hmac('sha256', $rawPayload, $webhookSecret);

if (!hash_equals($expectedSignature, $receivedSignature)) {
    http_response_code(401);
    echo json_encode(['status' => 'error']);
    exit;
}

$data = json_decode($rawPayload, true);

switch ($data['event']) {
    case 'shipped':
        // Update your system: mark order as shipped
        break;
    case 'cancelled':
        // Balance is auto-refunded by X-Institute
        break;
}

http_response_code(200);
echo json_encode(['status' => 'success']);

Event Types

API Key Security

1. Never share your API key — treat it like a password
2. Store it securely — use environment variables, never hardcode in source
3. Use HTTPS only — all API requests must be over HTTPS
4. Rotate regularly — revoke and regenerate your key periodically
5. Revoke immediately if you suspect your key has been compromised

Best Practice Example

// ✅ GOOD: Store API key in environment variable
$apiKey = getenv('XINSTITUTE_API_KEY');

// ❌ BAD: Never hardcode your API key
$apiKey = 'a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6'; // DANGEROUS!

PHP

$apiKey = getenv('XINSTITUTE_API_KEY');
$baseUrl = 'https://v1.x-institute.site';

// Fetch products
$ch = curl_init($baseUrl . '/products');
curl_setopt($ch, CURLOPT_HTTPHEADER, [
    'Authorization: Bearer ' . $apiKey,
    'Accept: application/json'
]);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
$response = curl_exec($ch);
curl_close($ch);

$products = json_decode($response, true);
print_r($products);

Python

import os
import requests

API_KEY = os.environ.get('XINSTITUTE_API_KEY')
BASE_URL = 'https://v1.x-institute.site'

headers = {
    'Authorization': f'Bearer {API_KEY}',
    'Accept': 'application/json'
}

# Fetch products
response = requests.get(f'{BASE_URL}/products', headers=headers)
products = response.json()
print(products)

# Submit an order
order_data = {
    'customer_email': '[email protected]',
    'products': [
        {'product_id': 'SPOTIFY_1Y', 'quantity': 1}
    ]
}
response = requests.post(f'{BASE_URL}/order', json=order_data, headers=headers)
print(response.json())

JavaScript (Node.js)

const API_KEY = process.env.XINSTITUTE_API_KEY;
const BASE_URL = 'https://v1.x-institute.site';

// Fetch products
const response = await fetch(BASE_URL + '/products', {
    headers: {
        'Authorization': 'Bearer ' + API_KEY,
        'Accept': 'application/json'
    }
});
const products = await response.json();
console.log(products);

// Submit an order
const orderResponse = await fetch(BASE_URL + '/order', {
    method: 'POST',
    headers: {
        'Authorization': 'Bearer ' + API_KEY,
        'Content-Type': 'application/json'
    },
    body: JSON.stringify({
        customer_email: '[email protected]',
        products: [{ product_id: 'SPOTIFY_1Y', quantity: 1 }]
    })
});
const order = await orderResponse.json();
console.log(order);