Reseller API

Create your API key in Settings → Reseller API (2FA must be enabled). Optionally restrict it to your server IPs. All prices are in USD and charged from your balance.

Option A — DHRU Fusion compatible

If your site runs DHRU Fusion or a compatible panel, add us as a supplier:

API URL:      https://YOUR-DOMAIN/api/index.php
Username:     your username
API Key:      your API key (cg_…)

Supported actions: accountinfo, imeiservicelist, placeimeiorder (ID, IMEI), getimeiorder (ID). Status codes: 0 pending, 1 in process, 3 rejected (refunded), 4 success.

Option B — REST API v1 (HMAC signed)

Base URL https://YOUR-DOMAIN/api/v1. Every request needs these headers:

X-Api-Key:   cg_xxxxxxxx
X-Timestamp: 1794422799            (unix seconds, ±5 min)
X-Signature: hex( HMAC_SHA256( api_secret, "{timestamp}.{METHOD}.{path}.{rawBody}" ) )

path includes the prefix, e.g. /api/v1/orders. For GET requests the body is an empty string.

Endpoints

GET  /api/v1/balance            → { balance, currency }
GET  /api/v1/services           → { services: [{ id, name, price, field, delivery_time }] }
POST /api/v1/orders             { service_id, input, qty?, note? } → { order }
GET  /api/v1/orders/{code}      → { order: { code, status, result, … } }

field tells you what input must contain: imei (15 digits), sn, user, or none (empty string). Order status: pending, process, done, rejected (auto-refunded).

Example (Node.js)

import crypto from 'node:crypto';
const KEY = 'cg_…', SECRET = '…', BASE = 'https://YOUR-DOMAIN';

async function call(method, path, body) {
  const raw = body ? JSON.stringify(body) : '';
  const ts = Math.floor(Date.now() / 1000);
  const sig = crypto.createHmac('sha256', SECRET).update(`${ts}.${method}.${path}.${raw}`).digest('hex');
  const r = await fetch(BASE + path, { method, body: raw || undefined,
    headers: { 'content-type': 'application/json', 'x-api-key': KEY, 'x-timestamp': ts, 'x-signature': sig } });
  return r.json();
}
console.log(await call('POST', '/api/v1/orders', { service_id: 1, input: '356789012345678' }));

Example (PHP)

$body = json_encode(['service_id' => 1, 'input' => '356789012345678']);
$ts = time();
$sig = hash_hmac('sha256', "$ts.POST./api/v1/orders.$body", $SECRET);
$ch = curl_init("$BASE/api/v1/orders");
curl_setopt_array($ch, [CURLOPT_POST => 1, CURLOPT_POSTFIELDS => $body, CURLOPT_RETURNTRANSFER => 1,
  CURLOPT_HTTPHEADER => ['Content-Type: application/json', "X-Api-Key: $KEY", "X-Timestamp: $ts", "X-Signature: $sig"]]);
echo curl_exec($ch);

Errors

JSON { "error": "CODE" } with HTTP status: 401 INVALID_API_KEY / INVALID_SIGNATURE / TIMESTAMP_EXPIRED, 403 IP_NOT_ALLOWED, 402 INSUFFICIENT_BALANCE, 400 invalid input, 429 TOO_MANY_REQUESTS (120 req/min).