Skip to content
Xegora Integration API v1

Issue gift cards & eSIMs with a quote and one call

One catalog for every product family. Prices lock in a binding quote, orders are idempotent against your prepaid wallet, and webhooks are signed — so retries are safe and launch day is boring.

API keys are issued and managed in the merchant dashboard once your workspace is approved.

The lifecycle

How an order flows

One short loop — four calls and a signed webhook — and it's the same loop for every product family.

  1. Find a product

    GET /products

    Search one catalog of gift cards, eSIM plans, and top-ups by country, category, or text.

  2. Lock a quote

    POST /quotes

    A binding total in your sell currency, valid for a few minutes. The quote is the price.

  3. Place the order

    POST /orders

    Idempotent against your prepaid wallet — replays with the same key return the same order.

  4. Get the webhook

    order.fulfilled

    A signed event tells you the moment fulfillment completes. No polling loops.

  5. Reveal the code

    POST /orders/{id}/fulfillment

    Fetch codes and PINs over a dedicated, audited endpoint — never cached, every reveal counted.

Quick start

Your language, plain HTTPS

A clean, predictable REST API — JSON in, JSON out, an X-Api-Key header, and no SDK required. Quote, order, reveal: your first order is three calls.

create-order.ts
const BASE = "https://integration.xegora.com/api/v1";
const headers = {
"X-Api-Key": process.env.XEGORA_API_KEY!,
"Content-Type": "application/json",
};
const quote = await fetch(`${BASE}/quotes`, {
method: "POST",
headers,
body: JSON.stringify({ productId, variantId, quantity: 1, currency: "USD" }),
}).then((r) => r.json());
const order = await fetch(`${BASE}/orders`, {
method: "POST",
headers: { ...headers, "Idempotency-Key": "order-10231" },
body: JSON.stringify({ quoteId: quote.id, clientReference: "po-10231" }),
}).then((r) => r.json());
console.log(order.status); // "reserved" — poll until "fulfilled", then reveal
  • Idempotent orders
  • Signed webhooks
  • Scoped API keys
  • Prefunded wallet
API reference

The core surface, end to end

Real request and response shapes — click any row. Withdrawals, deposit history, and product images round out the surface; the complete reference lives at docs.xegora.com.

POST /api/v1/orders

Create an order from a quote against your prepaid wallet. The Idempotency-Key header is required — identical keys return the same order. Scope: orders.create.

Example response202 Accepted
{
  "id": "0198e000-1111-7abc-9def-222233334444",
  "clientReference": "po-10231",
  "status": "reserved",
  "total": 52.50,
  "currency": "USD",
  "createdAtUtc": "2026-09-05T12:01:02Z",
  "updatedAtUtc": "2026-09-05T12:01:02Z"
}

Everything else is on docs.xegora.com

The complete developer documentation — every endpoint with request and response schemas, webhook signature verification in three languages, and the full OpenAPI 3.1 specification.

  • Getting started
  • Authentication
  • Orders & quotes
  • Webhooks
  • Go-live
Built for production

The boring infrastructure you actually want

Everything that makes an issuing integration survive real traffic — idempotency, signatures, scoped credentials, and a wallet that can't overspend.

Unified catalog

Gift cards, eSIM plans, and phone top-ups share one schema, one price feed, and one order flow. Integrate once and every product Xegora adds is yours automatically.

Idempotent orders

Order creation and fulfillment reveal both take an Idempotency-Key header. Network blip, timeout, aggressive retry loop — replay the request as many times as you like and exactly one order exists.

Signed webhooks

order.processing, order.fulfilled, order.failed, order.refunded, and wallet.credited are delivered over HTTPS with an HMAC-SHA256 signature (X-Xegora-Signature), retried at-least-once, and deduplicated by a stable X-Xegora-Event-Id.

Least-privilege keys

Every key carries an explicit scope set — catalog reads, quoting, ordering, wallet reads, and money-moving scopes are all separate — plus an optional CIDR allow-list and expiry. Revocation is immediate.

Prefunded wallet

Orders reserve from your prepaid balance and capture on fulfillment; failures release the reservation automatically. Fund it with BSC-USD to a permanent deposit address, and withdraw unused funds only to your own registered payout details.

Country-aware catalog

Query the catalog with a country code or category and get the right products, variants, and redemption terms — priced in your sell currency, updated as the catalog syncs.

Pricing

Wholesale prices, no surprises

The quote is the price. Everything else about your commercial terms is agreed when your merchant workspace is set up.

  • Wholesale product pricing in your sell currency — the quote's total is exactly what your wallet is debited
  • No hidden per-call fees; a flat 120 requests/minute rate limit per workspace
  • Your workspace plan (setup and terms) is agreed at merchant onboarding
  • Withdrawals of unused funds are quoted transparently — fee, net, and payout date up front

Ready to issue your first order?

Apply for a merchant workspace from your account, get approved, and issue scoped API keys from the dashboard — then your first order is three calls away. The full reference is waiting at docs.xegora.com.