Your whole store, one API call away
Connect PapelShip to your own systems with a comprehensive REST API, signed webhooks, a browser SDK and a license API.
- Rate limit
- 300 requests a minute
- Webhook signatures
- HMAC-SHA256
- Retries
- From 1 minute to 12 hours
- Idempotency
- On create operations
Developers
PapelShip is designed so that almost everything you can do in the dashboard, you can also do through the API. Sync products, create payment pages, process orders, manage licenses and listen to events in real time. A consistent response format, granular permissions and reliable webhook delivery make your integration production-ready from the first day.
Create invoice
REST
Request
POST · create
Idempotency-Key: 7d1f0c2a-…
Response
Invoice created
X-Request-Id: req_4c1e9a…
Rate limit13 of 300 used this minute
Webhook deliveries
HMAC-SHA256
- 200Delivered
Order event
Signed · attempt 1
- 200Delivered
Stock event
Signed · attempt 1
- 503Retry in 1 min
Review event
Signed · attempt 1
- 200Delivered
Withdrawal event
Signed · attempt 1
1 min…12 hretry window
Features
APIs built for production. Granular access, predictable behaviour and reliable delivery.
Comprehensive REST API
Products, variants, stock, serial numbers, files, categories, invoices, orders, shipping and refunds, customers, coupons, campaigns, subscriptions, support tickets, reviews, questions, affiliates and webhooks. Actions such as creating invoices, refunds, cancellations, PDFs and resending deliveries are in the API too.
Secure, controlled access
API keys with read and write permissions per resource, read-only keys, expiry dates and IP whitelists. See the call and error count for every key.
Built for production
A consistent response format, a tracking ID on every request (
X-Request-Id) andIdempotency-Keysupport on create operations. A limit of 300 requests a minute, with clear rate-limit headers.Signed webhooks
Receive order, product, stock, review, verification, customer, withdrawal and affiliate events in real time. Every request is signed with HMAC-SHA256, and failed deliveries are retried automatically at growing intervals, from 1 minute up to 12 hours. There is a delivery log, manual resend and test sends, and you can route webhooks straight to a Discord channel.
Browser SDK and embedded checkout
Manage the cart, products and checkout from your own interface with the
window.PapelShipSDK, and open checkout as a page or as an embedded window.Payments API
Hosted payment links, crypto payment invoices with address, amount and QR code, payment status lookups and refunds, with an OpenAPI schema and its own signed webhook.
License API
Look up qPapel licenses, reset hardware locks, freeze, ban and add time. A separate reseller API is available for your resellers.
MCP for AI agents
Connect AI tools such as Claude, Cursor and VS Code securely with OAuth and let them edit your theme code. Changes are saved as drafts, and publishing stays in your hands.
Ready-made plugins
Payment plugins for WooCommerce, XenForo, WHMCS, Magento and more.
How it works
Three steps to get started.
- 01
Create an API key
Choose the permissions it needs.
- 02
Add your webhook endpoint
Send a test event.
- 03
Take your integration live.
Keep exploring
Products, docs and guides. Where to next.
- DocsQuickstartSet up access and make your first request.
- DocsAuthenticationAPI keys and how requests are authorised.
- DocsStore API referenceProducts, orders, customers and the rest of your store.
- DocsWebhooksReceive store events and verify their signatures.
- DocsqPapel API referenceManage licenses from your own systems.
- DocsMCP for AI toolsConnect AI coding tools to your theme code.
- GuideHow to add a checkout widget to your website: embedded checkout for card, crypto and bank transferAdd a checkout widget to your website with one script tag. How embedded checkout works, how to set it up, which payment methods it takes and what happens next.
- GuideCrypto POS API integration: checkout, in-store terminals and payoutsA developer's guide to crypto POS API integration: create invoices server-side, handle webhooks idempotently, take crypto in store and reconcile payouts.
