API documentation

Base URL

All responses are JSON. The API version is in the path, so /api/v1 will not change shape underneath you.

Authentication

Send your key on every request, either way:

Authorization: Bearer bk_live_xxxxxxxx_yyyyyyyyyyyy
X-API-Key: bk_live_xxxxxxxx_yyyyyyyyyyyy

Keys are shown once at creation and stored only as a hash — we cannot recover one for you. Treat a key like a password: keep it server-side, never in browser or mobile code, and revoke it immediately if it leaks.

Scopes

Rate limits

60 requests per minute per key, on a sliding window. Every response carries your current position:

X-RateLimit-Limit: 60
X-RateLimit-Remaining: 57
X-RateLimit-Reset: 60

Exceeding it returns 429 with a Retry-After header. Back off for that many seconds rather than retrying immediately.

Endpoints

Example: buy a product

Purchases are paid from your wallet balance — top up at /wallet. There is no card flow in the API.

Request

POST https://skshopping.store/api/v1/orders
X-API-Key: bk_live_xxxxxxxx_yyyyyyyyyyyy
Content-Type: application/json

{"product_id": 2, "quantity": 1}

Response 201

{
  "id": 42,
  "status": "delivered",
  "total_price": "0.01",
  "created_at": "2026-07-26T10:15:00",
  "items": ["user@example.com|password123"]
}

Example: rent an SMS number

Rentals are charged to your wallet the moment the number is issued. If no code arrives within the delivery window the rental is refunded to your wallet automatically — you do not need to ask.

Supported countries

Availability and pricing change often, so treat this table as a snapshot and read GET /sms/countries at runtime rather than hardcoding it. Not every country is offered for every service.

country_code is the ISO 3166-1 alpha-2 code and is case-insensitive. Requesting a country a service does not offer returns 400 sms_order_failed, with the reason in message.

Request — list what is available

GET https://skshopping.store/api/v1/sms/countries?service=facebook
X-API-Key: bk_live_xxxxxxxx_yyyyyyyyyyyy

Response 200

[
  {"country": "United States", "code": "US", "price": "0.06", "success_rate": 0.92},
  {"country": "Cambodia",      "code": "KH", "price": "0.06", "success_rate": 0.88},
  {"country": "Hong Kong",     "code": "HK", "price": "0.07", "success_rate": null}
]

success_rate is the recent delivery rate, or null when there is not enough history yet. Prefer a country with a high rate when you have a choice.

Request — rent a Hong Kong number

POST https://skshopping.store/api/v1/sms/orders
X-API-Key: bk_live_xxxxxxxx_yyyyyyyyyyyy
Content-Type: application/json

{"service": "facebook", "country_code": "HK"}

Response 201

{
  "id": 128,
  "service": "facebook",
  "country": "hk",
  "phone": "85260123456",
  "status": "waiting_sms",
  "price": "0.07",
  "code": ""
}

Poll for the code

GET https://skshopping.store/api/v1/sms/orders/128
X-API-Key: bk_live_xxxxxxxx_yyyyyyyyyyyy

{"id": 128, "status": "completed", "code": "123456", ...}

Poll every few seconds, not in a tight loop — polling counts against your rate limit. status settles on completed, refunded or failed.

Errors

Every failure uses the same shape, so you only need one handler:

{
  "error": {
    "code": "insufficient_balance",
    "message": "Wallet balance $0.50 is short of $10.00.",
    "status": 402,
    "request_id": "9f2c1a77b0e34d18"
  }
}

Quote the request_id in any support message — it identifies the exact call in our logs.

SDK examples

curl -X POST https://skshopping.store/api/v1/orders \
  -H "X-API-Key: $BONDOM_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"product_id": 2, "quantity": 1}'

const BASE = "https://skshopping.store/api/v1";

async function buy(productId, quantity = 1) {
  const res = await fetch(`${BASE}/orders`, {
    method: "POST",
    headers: {
      "X-API-Key": process.env.BONDOM_API_KEY,
      "Content-Type": "application/json",
    },
    body: JSON.stringify({ product_id: productId, quantity }),
  });

  const data = await res.json();
  if (!res.ok) {
    // Every failure has the same shape.
    throw new Error(`${data.error.code}: ${data.error.message}`);
  }
  return data.items;          // delivered credentials
}

buy(2).then(console.log).catch(console.error);

<?php
$base = "https://skshopping.store/api/v1";

function bondom($method, $path, $body = null) {
    global $base;
    $ch = curl_init($base . $path);
    curl_setopt_array($ch, [
        CURLOPT_RETURNTRANSFER => true,
        CURLOPT_CUSTOMREQUEST  => $method,
        CURLOPT_HTTPHEADER     => [
            "X-API-Key: " . getenv("BONDOM_API_KEY"),
            "Content-Type: application/json",
        ],
        CURLOPT_POSTFIELDS => $body ? json_encode($body) : null,
    ]);
    $raw    = curl_exec($ch);
    $status = curl_getinfo($ch, CURLINFO_HTTP_CODE);
    curl_close($ch);

    $data = json_decode($raw, true);
    if ($status >= 400) {
        throw new Exception($data["error"]["code"] . ": " . $data["error"]["message"]);
    }
    return $data;
}

$order = bondom("POST", "/orders", ["product_id" => 2, "quantity" => 1]);
print_r($order["items"]);

import os
import requests

BASE = "https://skshopping.store/api/v1"
SESSION = requests.Session()
SESSION.headers["X-API-Key"] = os.environ["BONDOM_API_KEY"]


class BondomError(Exception):
    pass


def request(method, path, **kwargs):
    res = SESSION.request(method, BASE + path, timeout=30, **kwargs)
    data = res.json()
    if not res.ok:
        err = data["error"]
        raise BondomError(f"{err['code']}: {err['message']}")
    return data


def buy(product_id: int, quantity: int = 1) -> list[str]:
    order = request("POST", "/orders",
                    json={"product_id": product_id, "quantity": quantity})
    return order["items"]


print(buy(2))