Getting started

This page takes you from nothing to your first successful request.

1. Get API access

Fulfillbot turns API access on per account. Ask your account manager. When it is on, the portal shows Settings → API access.

2. Create an API key

Sign in to the portal and open Settings → API access.
Under Create an API key, enter a name for the key (up to 60 characters), for example the system that will use it.
Choose an access level (see the table below). With Custom you tick the permissions yourself.
Click Create API key and copy the key straight away. It is shown only once; we keep only a hash of it.

Access level	Permissions
Read only	`wallet:read`, `catalog:read`, `orders:read`, `purchase_orders:read`, `shipments:read`, `requests:read`, `quotes:read`
Read and create orders	`wallet:read`, `catalog:read`, `orders:read`, `purchase_orders:read`, `shipments:read`, `requests:read`, `quotes:read`, `orders:write`
Custom	The ones you tick

When a key can create orders, the portal shows a note about charges first: read Charges and your wallet.

For your security you must have signed in within the last 10 minutes to create a key; otherwise the portal asks you to sign in again. Keys can't be created while your account is on hold. An account can have up to 10 active keys; revoke one you no longer use to add another.

3. Store the key safely

Keys start with pak_. Treat a key like a password: anyone who has it can use your account within its permissions. Keep it in an environment variable or a secrets manager, never in source code, a web page or a mobile app. The examples in these docs read it from FULFILLBOT_API_KEY:

export FULFILLBOT_API_KEY="pak_..."

If a key leaks, revoke it in Settings → API access. It stops working at once. Then create a new one.

4. Make your first request

GET /v1/me works with any valid key and tells you which account and key a request uses.

The Node.js examples need Node.js 18 or later (built-in fetch, top-level await; save them as .mjs). The Python examples use the requests package (pip install requests).

If you get 401 invalid_api_key, check that the header is exactly Authorization: Bearer <key>. If you get 403 api_not_enabled, API access is off for your account. See Authentication.

curlNode.jsPython

curl 'https://api.rephut.com/v1/me' \
  -H "Authorization: Bearer $FULFILLBOT_API_KEY"

const response = await fetch("https://api.rephut.com/v1/me", {
  headers: {
    Authorization: `Bearer ${process.env.FULFILLBOT_API_KEY}`,
  },
});
const result = await response.json();
console.log(response.status, result);

import os

import requests

response = requests.get(
    "https://api.rephut.com/v1/me",
    headers={
        "Authorization": f"Bearer {os.environ['FULFILLBOT_API_KEY']}",
    },
    timeout=30,
)
print(response.status_code, response.json())

Response 200

{
  "success": true,
  "data": {
    "customer": {
      "id": "cm2x8k1p40000abcd1234wxyz",
      "name": "Northwind Goods"
    },
    "apiKey": {
      "id": "cm3a1b2c30000keyd5678abcd",
      "name": "Order sync",
      "keyPrefix": "pak_7Hq2Lm9X",
      "scopes": [
        "wallet:read",
        "catalog:read",
        "orders:read",
        "purchase_orders:read",
        "shipments:read",
        "requests:read",
        "quotes:read",
        "orders:write"
      ]
    }
  }
}

5. Next steps

Authentication: permissions and why a key can be refused.
Errors, Rate limits and Idempotency before you write.
Charges and your wallet before you create orders.
Webhooks so you don't need to poll.
From order to delivery for a complete walk-through.