Developer & API Terms

These Developer & API Terms apply when you create an API key or call our public API. They add to, and do not replace, our Terms of Service.

1. Licence

We grant you a personal, non-exclusive, non-transferable, revocable licence to call the API for the purpose of integrating Bondom Account into your own site or application. You may not sublicense, resell, or provide the API itself to others as a service.

2. API keys

• A key is shown once, at creation. We store only a SHA-256 hash and cannot recover the key for you — if you lose it, create a new one.
• Keys are secrets. Keep them server-side. Never put a key in browser JavaScript, a mobile app binary, a public repository, or a support message.
• Every call made with your key is your responsibility, including calls made by someone who obtained it from you.
• Revoke a compromised key immediately in the Developer Portal. Revocation takes effect at once.
• We may revoke a key without notice if we believe it is compromised or is being used in breach of these terms.

3. Scopes

Keys carry explicit scopes — read, orders, sms — and a call outside a key's scopes is refused. Grant each key the narrowest set that its integration actually needs. Do not attempt to access data or endpoints outside your granted scopes.

4. Rate limits and fair use

Each key has a published per-minute limit. Every response returns your current position in the X-RateLimit-* headers, and exceeding the limit returns 429 with Retry-After.

You must respect those headers and back off rather than retrying immediately. Do not run parallel clients to multiply your limit, create extra accounts or keys to evade it, or poll faster than the data actually changes. We may reduce a limit, or suspend a key, where usage threatens service stability for others.

5. Purchases through the API

API purchases spend the wallet balance of the key's owner, exactly as the website and bot do. There is no card flow in the API. You are responsible for every purchase your integration makes — a bug in your code that buys in a loop spends real money, and those purchases are not automatically refundable.

We strongly recommend testing against a small balance first, handling 402 insufficient_balance explicitly, and never retrying a failed purchase blindly.

6. Your obligations to your users

If you resell or expose our products to your own users, you must:

• make clear that you, not Bondom Account, are their counterparty;
• not present yourself as an agent, partner, or official representative of ours without written agreement;
• publish your own terms and privacy notice covering the data you collect;
• handle your users' refund and support requests yourself, and not direct them to us as first-line support.

7. Prohibited use

You must not use the API to scrape our catalogue wholesale for a competing listing, to probe or attack our infrastructure, to circumvent rate limits, scopes, or authentication, or for anything prohibited by our Acceptable Use Policy. Do not use the API to enumerate identifiers belonging to other accounts; requests for records you do not own are deliberately indistinguishable from records that do not exist.

8. Changes to the API

The API is versioned. Within /api/v1 we aim to make only backward-compatible changes — adding fields or endpoints, never removing or renaming what is already there. Build clients that ignore unknown fields.

Breaking changes will ship as a new version path. If we retire a version, we will give reasonable notice through the Developer Portal before it stops working.

9. No warranty; availability

The API is provided "as is". We do not offer an uptime guarantee or a service level agreement. Endpoints that depend on third parties — most obviously payments and SMS — can fail when those providers fail, and will return a 503 when we detect it.

10. Suspension

We may suspend or terminate your API access for breach of these terms, for abusive load, or where required by law. Where practical we will tell you why and give you a chance to fix it first.

11. Support

Include the request_id from the error response when reporting a problem — it identifies the exact call in our logs and is the fastest route to an answer.

Questions about this document? Contact us at @bondomaccount_bot or khun_seivkheng@bkrt.