The Rebilly API is built on HTTP and is RESTful. It has predictable resource URLs and returns HTTP response codes to indicate errors. It also accepts and returns JSON in the HTTP body. Use your favorite HTTP/REST library in your programming language when using this API, or use one of the Rebilly SDKs, which are available in PHP and JavaScript.
Every action in the Rebilly UI is supported by an API which is documented and available for use, so that you may automate any necessary workflows or processes. This API reference documentation contains the most commonly integrated resources.
This topic describes the different forms of authentication that are available in the Rebilly API, and how to use them.
Rebilly offers four forms of authentication: secret key, publishable key, JSON Web Tokens, and public signature key.
To create or manage API keys, select one of the following:
For more information on API keys, see API keys.
Rebilly follows the error response format proposed in RFC 9457, which is also known as Problem Details for HTTP APIs. As with any API responses, your client must be prepared to gracefully handle additional members of the response.
Rebilly provides a JavaScript SDK and a PHP SDK to help interact with the Rebilly API. However, no SDK is required to use the API.
Rebilly also provides FramePay, a client-side iFrame-based solution, to help create payment tokens while minimizing PCI DSS compliance burdens and maximizing your customization ability. FramePay interacts with the payment tokens creation operation.
For installation and usage instructions, see SDKs. All JavaScript SDK code examples are included in the API reference documentation.
For installation and usage instructions, see SDKs. All SDK code examples are included in the API reference documentation. To use them, you must configure the $client as follows:
$client = new Rebilly\Client([ 'apiKey' => 'YourApiKeyHere', 'baseUrl' => 'https://api.rebilly.com', ]);
The full Rebilly API has over 500 operations. This is likely more than you may need to implement your use cases. If you would like to implement a particular use case, contact Rebilly for guidance and feedback on the best API operations to use for the task.
To integrate Rebilly, and learn about related resources and concepts, see Get started.
Rebilly enforces rate limits on the API to ensure that no single organization consumes too many resources. Rate limits are applied to the organization, and not to the API key. In sandbox environment, rate limits are enforced for non-GET endpoints and are set at 3000 requests per 10 minutes. You can find the exact number of consumed requests in the X-RateLimit-Limit and X-RateLimit-Remaining headers in the response. If the rate limit is exceeded, the API returns a 429 Too Many Requests response and a X-RateLimit-Retry-After header that includes a UTC timestamp of when the rate limit resets.
Use these operations to manage customers. A customer is an entity that purchases goods or services from you (a merchant), and is the payee in any transaction that is credited to you. Customers are associated with payment instruments, subscriptions, invoices, and other related resources.
In other systems, customers may be referred to as accounts, clients, members, patrons, or players. For information on the customer resource, see Resources.
curl -i -X GET \ https://www.rebilly.com/_mock/docs/dev-docs/api/authentication-options \ -H 'REB-APIKEY: YOUR_API_KEY_HERE'
{ "passwordPattern": "/^[0-9]+$/", "credentialTtl": 0, "authTokenTtl": 0, "resetTokenTtl": 0, "otpRequired": true, "_links": [ { … } ] }
curl -i -X PUT \ https://www.rebilly.com/_mock/docs/dev-docs/api/authentication-options \ -H 'Content-Type: application/json' \ -H 'REB-APIKEY: YOUR_API_KEY_HERE' \ -d '{ "passwordPattern": "/^[0-9]+$/", "credentialTtl": 0, "authTokenTtl": 0, "resetTokenTtl": 0, "otpRequired": true }'
Authentication options updated.
Total number of rate limit tokens for this request within a rate limit period. For more information, see Rate limits.
{ "passwordPattern": "/^[0-9]+$/", "credentialTtl": 0, "authTokenTtl": 0, "resetTokenTtl": 0, "otpRequired": true, "_links": [ { … } ] }
curl -i -X GET \ 'https://www.rebilly.com/_mock/docs/dev-docs/api/authentication-tokens?limit=1000&offset=1000' \ -H 'REB-APIKEY: YOUR_API_KEY_HERE'
[ { "username": "string", "customerId": "cus_0YV7DDSDD1C8DA64KHH2W33CPF", "token": "string", "otpRequired": true, "credentialId": "4f6cf35x-2c4y-483z-a0a9-158621f77a21", "expiredTime": "2019-08-24T14:15:22Z", "_links": [ … ] } ]
AuthenticationToken resource.
Specifies the authentication verification method. The password token requires the user to enter a password to log in. The passwordless token, requires a secret API key to log in. To obtain an API key, see Manage API keys.
Specifies if a One-Time Password (OTP) is required to exchange the authentication token.
curl -i -X POST \ https://www.rebilly.com/_mock/docs/dev-docs/api/authentication-tokens \ -H 'Content-Type: application/json' \ -H 'REB-APIKEY: YOUR_API_KEY_HERE' \ -d '{ "username": "string", "password": "pa$$word", "mode": "password", "otpRequired": true, "credentialId": "4f6cf35x-2c4y-483z-a0a9-158621f77a21", "expiredTime": "2019-08-24T14:15:22Z" }'
Login successful.
Total number of rate limit tokens for this request within a rate limit period. For more information, see Rate limits.
ID of the customer resource.
Specifies if a One-Time Password (OTP) is required to exchange the authentication token.
{ "username": "string", "customerId": "cus_0YV7DDSDD1C8DA64KHH2W33CPF", "token": "string", "otpRequired": true, "credentialId": "4f6cf35x-2c4y-483z-a0a9-158621f77a21", "expiredTime": "2019-08-24T14:15:22Z", "_links": [ { … } ] }