Getting Started with the Astroune API

Authentication

Every request authenticates with a scoped API key sent in the request header — scoped meaning a key can be limited to exactly the resources it needs (read-only access to sales data, for instance) rather than full account access. Generate separate keys per integration, so revoking one doesn't break every connected system at once.

How requests and responses are structured

The API follows standard REST conventions — resources are nouns, actions are HTTP verbs, and responses come back as JSON with consistent error objects so failures are programmatically distinguishable from success, not just an HTTP status code you have to interpret.

Webhooks, not polling

For anything event-driven — a new order, a stock alert, a payment received — subscribe to a webhook rather than polling on a timer. Polling wastes your rate limit and still introduces delay; a webhook fires the moment the event happens on our side.

Before you build against it

• Use the sandbox environment first — it's seeded with realistic test data so you can build and break things without touching production records.
• Design for retries — network failures happen, and idempotent request design (safe to retry without creating duplicates) will save you a production incident later.
• Talk to us before you build anything at high volume. Rate limits are generous for normal use, but a bulk migration or high-frequency polling job usually needs a conversation first, not a support ticket after the fact.