The Shop API lets you connect your own app to one Popbob shop. Each API key is limited to that shop and to the permissions it was created with.
How the API works
Your app sends its API key in an Authorization header with every request. Popbob verifies the key, identifies its shop, and only returns data that the key is allowed to access.
The API can read products, update stock, complete orders, and send customer messages, including live messages for delivery bots. It cannot access your account, payouts, or shop settings. Each endpoint has its own reference page with the request and response format.
The API uses JSON responses. Send requests tohttps://popbob.gg/api/v1; do not call Superpanel routes from an integration.
Create an API key
- 1
Open the API integration
In the Superpanel, open Integrations and select API.
- 2
Create and copy the key
Give the key a clear name, such as “Bank stock sync”, then copy it immediately. Popbob only displays the complete key once.
Only the shop owner can create or revoke API keys.
Authenticate requests
Send the complete key with the HTTP Authorizationheader. The key is a bearer token, so no cookies, account password, or browser login are needed.
Authorization: Bearer pb_live_your_key_herePopbob only shows the full key at creation time. The API key page later shows its name and prefix, but never its secret value.
Permissions and limits
Choose only the permissions your app needs. A key can have one or more of the following permissions:
Read products & stock
products:read allows the app to list product IDs, names, and current stock. This is required for the currently available List products endpoint.
Update stock
inventory:write allows the app to set a product's available stock.
Send messages
messages:write allows the app to send messages to customers who have purchased from the shop. API messages share the usual shop messaging limits with Superpanel messages.
Read and stream messages
messages:read allows the app to read customer conversations and receive live messages through a shop-scoped WebSocket connection. Use this for bots that respond to delivery requests. Add messages:write if the bot should reply.
Complete orders
orders:complete allows the app to complete an order and upload delivery proof.
A shop can have up to 10 active API keys. Revoking a key stops it working immediately and removes it from that limit.
Each API key can make up to 60 requests per minute. The limit is counted independently for every key and resets at the start of the next minute.
This is a fixed one-minute window, not a rolling 60-second timer. For example, a key can make 60 requests between 12:00:00 and 12:00:59, then another 60 requests beginning at 12:01:00. Requests made with one API key do not consume the limit of another key, including keys from the same shop.
The limit applies to every public Shop API request and API WebSocket handshake. Pushed messages do not count as requests. It does not depend on your app's IP address or the number of servers your app uses.
Handle errors safely
Check the HTTP status code before relying on a response body. Error responses are JSON with an error string. Do not retry authentication and permission errors until you have fixed the key or its selected permissions.
For a 429 response, wait at least the number of seconds in the Retry-After header before retrying. Do not send repeated retries while waiting: they will remain limited until the next minute window begins.
Keep your key secure
Treat an API key like a password. Store it in your app's server-side environment or secret manager, never in browser code, a public repository, or a screenshot. Revoke the key from the API integration page immediately if you think it has been exposed.
