Examples

List products (cursor)

API=https://sandbox-api.ioneshop.cloud/v1
KEY=$IONESHOP_API_KEY
CURSOR=

while :; do
  if [ -n "$CURSOR" ]; then
    URL="$API/products?limit=100&cursor=$CURSOR"
  else
    URL="$API/products?limit=100"
  fi
  RESP=$(curl -sS "$URL" -H "Authorization: Bearer $KEY")
  echo "$RESP" | jq '.data[].id'
  CURSOR=$(echo "$RESP" | jq -r '.pagination.next_cursor // empty')
  [ -z "$CURSOR" ] && break
done

Create product

curl -sS -X POST "$API/products" \
  -H "Authorization: Bearer $KEY" \
  -H "Idempotency-Key: $(uuidgen)" \
  -H "Content-Type: application/json" \
  -d '{
    "title": "Ceramic bottle 500ml",
    "status": "draft",
    "variants": [
      { "sku": "BOTTLE-500", "prices": [{ "amount": 2499, "currency": "EUR" }] }
    ]
  }'

Sync inventory absolute

curl -sS -X PUT "$API/inventory/levels" \
  -H "Authorization: Bearer $KEY" \
  -H "Idempotency-Key: inv_BOTTLE-500_2026-08-01T12" \
  -H "Content-Type: application/json" \
  -d '{
    "sku": "BOTTLE-500",
    "location_id": "sloc_main",
    "quantity": 120
  }'

Fetch paid orders since midnight

curl -sS "$API/orders?status=paid&updated_since=2026-08-01T00:00:00Z&limit=50" \
  -H "Authorization: Bearer $KEY"

Express webhook receiver (verify + ack)

import express from "express";
import { createHmac, timingSafeEqual } from "node:crypto";

const app = express();
app.post(
  "/hooks/ioneshop",
  express.raw({ type: "application/json" }),
  (req, res) => {
    const sig = req.header("x-ioneshop-signature") || "";
    const expected = createHmac("sha256", process.env.WH_SECRET)
      .update(req.body)
      .digest("hex");
    const ok =
      Buffer.from(expected, "hex").length === Buffer.from(sig, "hex").length &&
      timingSafeEqual(Buffer.from(expected, "hex"), Buffer.from(sig, "hex"));
    if (!ok) return res.status(401).send("invalid signature");
    // enqueue job…
    res.status(204).end();
  },
);

More recipes: Automation, n8n.