API & Integrations Hub
How authentication, requests, webhooks, and rate limiting work.
Authentication
Requests authenticate with a scoped API key sent in the request header. Keys can be scoped to specific resources (read-only sales data, for example) rather than granted full account access, and each connected integration should use its own key so revoking one doesn't affect the others.
Request conventions
The API follows standard REST conventions: resources are addressed as nouns, actions map to HTTP verbs, and every response returns consistent JSON, including structured error objects on failure rather than a bare status code.
Webhooks
Event-driven integrations (a new order, a stock alert, a payment received) should subscribe to a webhook rather than polling — webhooks fire the moment the event happens, include signature verification, and log delivery attempts with retry on failure.
Rate limits and sandbox
Rate limits are generous for typical integration use, with burst allowances for occasional spikes. A full sandbox environment, seeded with realistic test data, is available to build and test against before touching production.
Want the step-by-step version?
Getting Started with the Astroune API