Alaric Store - Reseller API v1

Base URL

https://api.alaricstore.com/api/v1

Authentication

Send your key in the X-API-Key header on every request. You can generate or regenerate it in the bot: Profile -> API Access.
Keep it secret. If it leaks, regenerate it: the old key stops working immediately.

X-API-Key: mk_xxxxxxxx_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
Content-Type: application/json

Limits

GET /balance, GET /products, GET /orders and GET /orders/:id: 30 requests per minute per key.
POST /orders: 10 requests per minute per key.
Quantity per order: 1 to 20.
Over the limit you get HTTP 429 and a Retry-After header.

GET`/balance`

Your wallet balance.

{ "balance": 24.5, "currency": "USDT" }

GET`/products`

Active products with YOUR price and the stock. Served from our cache, safe to poll every 30-60 seconds.

{
  "products": [
    {
      "id": "abc123",
      "name": "Gemini Pro 18 months",
      "price": 3.0,
      "currency": "USDT",
      "in_stock": true,
      "stock": 53,
      "max_quantity": 20,
      "fulfillment": "stock",
      "price_tiers": [ { "min_quantity": 5, "price": 2.8 } ]
    }
  ],
  "total": 1,
  "updated_at": "2026-01-01T00:00:00.000Z"
}

stock is a number for items held in stock, or null for items we fetch for you on demand (fulfillment: "on_demand").
price is the price per unit that will be charged to you.

POST`/orders`

Buy a product. The price is deducted from your wallet atomically and the order is fulfilled.

Header Idempotency-Key is REQUIRED: a unique string for each purchase you intend (8-96 characters: letters, digits, . _ : -). If a request times out, send the SAME request again with the SAME key: you will get the same order back and you are never charged twice. Use a NEW key for every new purchase.

POST https://api.alaricstore.com/api/v1/orders
Idempotency-Key: 6f1c2d9e-0b7a-4f53-9d1e-2a8b7c3d4e5f

{ "product_id": "abc123", "quantity": 2, "max_total": 6.5 }

max_total is optional: if the real total would be higher, nothing is charged and you get error PRICE_CHANGED.

Response (HTTP 201 for a new order, 200 when it is a replay of the same Idempotency-Key):

{
  "order_id": "ORD-W-1A2B3C4D5E6F",
  "status": "COMPLETED",
  "product_id": "abc123",
  "product": "Gemini Pro 18 months",
  "quantity": 2,
  "unit_price": 3.0,
  "total": 6.0,
  "currency": "USDT",
  "items": ["CODE-1", "CODE-2"],
  "balance_remaining": 18.5,
  "replayed": false,
  "created_at": "2026-01-01T00:00:00.000Z"
}

GET`/orders/:id`

Status and delivered items of one of your orders.

Statuses:

COMPLETED: delivered, items contains the codes.
PROCESSING: accepted and paid, being fetched. Poll this endpoint every 5-10 seconds (usually done within a minute). items is empty until it is COMPLETED.
REFUNDED: we could not deliver, the full amount went back to your wallet.
FAILED: the order did not complete.
UNDER_REVIEW: needs manual attention, contact support with the order_id.

GET`/orders`

Your latest API orders (summary only, no codes: use GET /orders/:id for the codes). Newest first.

limit (optional): 1 to 50, default 20.
before (optional): the next_before value of the previous page, to read older orders.

{
  "orders": [
    {
      "order_id": "ORD-W-1A2B3C4D5E6F",
      "status": "COMPLETED",
      "product_id": "abc123",
      "product": "Gemini Pro 18 months",
      "quantity": 2,
      "total": 6.0,
      "currency": "USDT",
      "created_at": "2026-01-01T00:00:00.000Z"
    }
  ],
  "next_before": "2026-01-01T00:00:00.000Z"
}

next_before is null when there are no older orders.

Errors

Every error looks like { "error": { "code": "...", "message": "..." } }.

400 VALIDATION, IDEMPOTENCY_KEY_REQUIRED: bad request.
401 INVALID_KEY: missing, unknown or revoked key.
402 INSUFFICIENT_BALANCE: top up your wallet (required and balance are included).
403 API_BANNED: your API access was disabled, contact support.
404 PRODUCT_NOT_FOUND, ORDER_NOT_FOUND.
409 OUT_OF_STOCK, INSUFFICIENT_LOCAL_STOCK (available included), PRICE_CHANGED (new_total included), IDEMPOTENCY_MISMATCH (same key, different request).
429 RATE_LIMITED: wait Retry-After seconds.
503 API_DISABLED, PRODUCT_TEMPORARILY_UNAVAILABLE, MAINTENANCE: try again later; nothing was charged.
500 / 504 INTERNAL, TIMEOUT: the order may or may not exist. Send the same request with the same Idempotency-Key again (or GET /orders/:id).

Quick example

curl -X POST https://api.alaricstore.com/api/v1/orders \
  -H "X-API-Key: YOUR_KEY" \
  -H "Idempotency-Key: $(uuidgen)" \
  -H "Content-Type: application/json" \
  -d '{"product_id":"abc123","quantity":1}'

const res = await fetch("https://api.alaricstore.com/api/v1/orders", {
  method: "POST",
  headers: {
    "X-API-Key": process.env.ALARIC_API_KEY,
    "Idempotency-Key": crypto.randomUUID(),
    "Content-Type": "application/json",
  },
  body: JSON.stringify({ product_id: "abc123", quantity: 1 }),
});
const order = await res.json();
console.log(res.status, order);

import os, uuid, requests

r = requests.post(
    "https://api.alaricstore.com/api/v1/orders",
    headers={
        "X-API-Key": os.environ["ALARIC_API_KEY"],
        "Idempotency-Key": str(uuid.uuid4()),
    },
    json={"product_id": "abc123", "quantity": 1},
    timeout=30,
)
print(r.status_code, r.json())

Good practice

Generate the Idempotency-Key BEFORE the first attempt and store it with your own order.
Never log or share your API key. Never put it in client-side code.
Save the delivered codes in your own database as soon as you receive them.
Treat PROCESSING as "paid, not delivered yet", never as a failure.

Support

Questions or a problem with an order? Contact: the Support button in our Telegram bot. Always include the order_id and the X-Request-Id response header.

Machine-readable spec

OpenAPI 3.0: https://api.alaricstore.com/api/v1/openapi.json (import it in Postman, Insomnia or Swagger tools).