List products

Endpoint

GET https://popbob.gg/api/v1/products

Only GET is supported. The response contains products from the shop attached to the API key and never from another shop.

Authentication and request body

Send your key as a bearer token. This endpoint does not accept a request body, query parameters, or cookies.

curl https://popbob.gg/api/v1/products \
  -H 'Authorization: Bearer pb_live_your_key_here'

Successful response

A successful request returns 200 and this JSON body:

{
  "products": [
    {
      "id": "67f15e3c3d6d55ab781ac123",
      "name": "Diamonds",
      "stock": 2500
    }
  ]
}

id is Popbob's product ID. stock is the current numeric quantity that customers can buy. Products are returned from oldest to newest by creation time; the product ID is used as a stable tie-breaker.

Errors

Missing, invalid, expired, or revoked keys return 401:

{
  "error": "Unauthorized"
}

A valid key without products:read returns403:

{
  "error": "Forbidden"
}

Unexpected server failures return 500. Retry these with backoff instead of immediately looping requests.

{
  "error": "Internal Server Error"
}

Rate limiting

Each API key can make 60 requests in each fixed minute window. The window starts on the minute, not when your first request arrives. Requests from separate API keys are counted separately, even when they belong to the same shop or come from the same IP address.

Request 61 in a window returns 429. The response body and headers are:

HTTP/1.1 429 Too Many Requests
Content-Type: application/json
Retry-After: 17

{
  "error": "Rate limit exceeded"
}

Retry-After is the number of whole seconds remaining until the next minute window. Its value changes based on when the limit was reached; 17 above is only an example. Wait at least that long before retrying. Popbob does not currently sendX-RateLimit-Limit, X-RateLimit-Remaining, or X-RateLimit-Reset headers.

A shop can have up to 10 active API keys. Revoked keys stop working immediately and no longer count toward that limit.