Developers

Your systems, talking to your evidence

Read orders and proofs, push warehouse records, and get told when something changes. The scopes are granular on purpose: a WMS integration should not arrive with your customer list attached.

Set up in 5 minutes, no code · Works with Shopify and WooCommerce

Integrations usually ask for everything

Most APIs hand out one key that opens the whole account. Give a warehouse partner access to pallet records and you have handed them orders, buyers and disputes too — with no way to take back just that part.

What you get

Scoped keys

Seven scopes, granted per key: orders read and write, proofs read and write, warehouse read and write, and webhook management.

Warehouse kept separate

Warehouse scopes are their own thing. A WMS integration can push pallet records without ever seeing an order or a buyer.

Signed webhooks

Each endpoint carries its own secret and its own event subscription, with delivery status and failure count visible to you rather than buried in a log.

Events that describe the business

Order approved, order disputed, order shipped, proof delivered, dispute resolved, plus two warehouse events — named after what happened, not after which table changed.

Revoke without redeploying

Keys show their prefix, last use time and last IP, and can be revoked one at a time. Rotating one integration does not disturb the others.

Retries you do not have to build

Failed deliveries are retried and the failure count sits on the endpoint, so a flaky receiver is visible rather than silent.

How it works

  1. 1

    Create a key

    Name it and tick only the scopes that integration genuinely needs.

  2. 2

    Call the API

    Bearer token. The key's prefix and last use are shown back to you in the dashboard.

  3. 3

    Subscribe to events

    Register an endpoint and choose which events it should receive.

  4. 4

    Verify and act

    Check the signature against that endpoint's secret, then do your thing.

Under the hood

Facts, not adjectives. Everything below describes what the product does today — nothing here is on a roadmap.

Availability

API access is included from Business. Warehouse scopes additionally require the Warehouse add-on.

Pricing
API scopes
7API scopes
Webhook events
7Webhook events
Signing secret per endpoint
1Signing secret per endpoint
Scopes
orders:read, orders:write, proofs:read, proofs:write, warehouse:read, warehouse:write, webhooks:manage
Webhook events
order.approved, order.disputed, order.shipped, proof.delivered, dispute.resolved, warehouse.record_created, warehouse.condition_recorded
Authentication
Bearer API key; only a hash is stored and the full key is shown once
Key visibility
Prefix, last used at, last used IP, revocation timestamp
Endpoint state
Active or disabled, with last delivery time and failure count
Signing
A separate secret per endpoint

Questions people actually ask

How is the key stored?

Only as a hash. You see the full key once, at creation, and a prefix afterwards so you can tell your keys apart in the dashboard.

Can I give a partner warehouse access only?

Yes — that is exactly why warehouse scopes exist separately from order scopes.

What happens if my endpoint is down?

Deliveries are retried, and the endpoint's failure count is visible in the dashboard, so you find out it is happening instead of discovering it weeks later.

Can I rotate keys without downtime?

Yes. Create the new key, move your integration across, then revoke the old one. Keys are independent, so nothing else is affected.

Record every order and use it as evidence when a dispute comes up.

Set up PallasMark in 5 minutes and turn every order into evidence that wins. No credit card required.