Open API
Read-only REST API for organizer data, plus signed webhooks. Base URL: https://ticket-web-production-22f6.up.railway.app/api/v1
Authentication
Create keys in your dashboard → Developers. Send them as a bearer token:
curl https://ticket-web-production-22f6.up.railway.app/api/v1/events \ -H "Authorization: Bearer sk_sandbox_xxx.yyy"
pk_publishable keys →events:readonly.sk_secret keys → scoped organizer reads. Keep them server-side.- Rate limit: 120 requests / minute / key (429 with
Retry-After).
Endpoints
| Method | Path | Scope | Description |
|---|---|---|---|
| GET | /v1/events | events:read | List your events with ticket types. |
| GET | /v1/orders | orders:read | List orders. Query: ?status=paid&limit=50. |
| GET | /v1/orders/{orderNumber} | orders:read | Order detail with fee breakdown, items, tickets. |
Webhooks
Register an endpoint in Developers. We POST events (e.g. order.paid) with a signature header:
X-20FIT-Signature: t=1720000000,v1=<hex hmac>
// verify: HMAC_SHA256(secret, `${t}.${rawBody}`) === v1Reject requests where the timestamp is older than ~5 minutes to prevent replay.