Reseller API Reference

Authorization: Bearer sd_live_a1b2c3d4e5f6...

GET /api/user/api-keys
Authorization: Bearer sd_live_...

// Response includes:
{
  "webhookSecret": "a3f9b2c1d4e5...",   // 64 hex chars — treat like a password
  ...
}

{
  "ok": false,
  "error": "Human-readable message",
  "code": "MACHINE_READABLE_CODE"
}

{
  "ok": true,
  "services": [
    {
      "id": "clxyz123",
      "name": "TikTok Accounts",
      "description": "Aged TikTok profiles ready for use.",
      "price": 9.90,
      "stock": 3,
      "delivery": "instant",
      "logoUrl": "https://cdn.simpleicons.org/tiktok",
      "createdAt": "2026-01-15T10:00:00.000Z"
    },
    {
      "id": "clxyz456",
      "name": "Google Voice Numbers",
      "description": "US Google Voice number with account credentials.",
      "price": 24.00,
      "stock": null,
      "delivery": "manual",
      "logoUrl": null,
      "createdAt": "2026-01-20T12:00:00.000Z"
    }
  ]
}

{
  "serviceId": "clxyz123",
  "quantity": 2
}

{
  "ok": true,
  "order": {
    "id": "ord_abc123",
    "serviceId": "clxyz123",
    "serviceName": "TikTok Accounts",
    "quantity": 2,
    "amount": 19.80,
    "status": "delivered",
    "delivery": "instant",
    "items": [
      { "email": "user1@example.com", "password": "P@ssw0rd1" },
      { "email": "user2@example.com", "password": "P@ssw0rd2" }
    ],
    "deliveredAt": "2026-05-30T14:22:00.137Z",
    "createdAt": "2026-05-30T14:22:00.000Z"
  }
}

{
  "ok": true,
  "order": {
    "id": "ord_def456",
    "serviceId": "clxyz456",
    "serviceName": "Google Voice Numbers",
    "quantity": 1,
    "amount": 24.00,
    "status": "pending",
    "delivery": "manual",
    "items": [],
    "deliveredAt": null,
    "createdAt": "2026-05-30T14:22:00.000Z"
  }
}

{
  "ok": true,
  "services": [
    {
      "id": "clxyz111",
      "name": "Instagram Followers: High Quality",
      "category": "Instagram",
      "description": null,
      "pricePerThousand": 1.50,
      "minQty": 100,
      "maxQty": 50000
    },
    {
      "id": "clxyz222",
      "name": "TikTok Views: Fast Delivery",
      "category": "TikTok",
      "description": null,
      "pricePerThousand": 0.08,
      "minQty": 500,
      "maxQty": 1000000
    }
  ]
}

{
  "ok": true,
  "balance": 45.20,
  "currency": "USD"
}

{
  "server": 1,
  "country": "usa",
  "service": "wa",
  "operator": "any"
}

{
  "ok": true,
  "order": {
    "id": "clxyz789",
    "orderId": 1234567890,
    "server": 1,
    "phone": "+12025551234",
    "service": "wa",
    "country": "usa",
    "price": 0.50,
    "status": "created",
    "sms": [],
    "createdAt": "2026-05-30T14:30:00.000Z"
  }
}

{
  "ok": true,
  "order": {
    "id": "clxyz789",
    "orderId": 1234567890,
    "server": 1,
    "phone": "+12025551234",
    "service": "wa",
    "country": "usa",
    "price": 0.50,
    "status": "received",
    "sms": [
      { "code": "123456", "text": "Your WhatsApp code: 123456" }
    ],
    "createdAt": "2026-05-30T14:30:00.000Z",
    "lastCheckAt": "2026-05-30T14:31:00.000Z"
  }
}

// Response
{ "ok": true, "cancelled": true, "refunded": true }

POST https://your-site.com/webhook/snappy
Content-Type: application/json
X-Snappy-Signature: sha256=a3f9b2c1d4e5...

{
  "event": "order.delivered",
  "orderId": "ord_def456",
  "serviceId": "clxyz456",
  "serviceName": "Google Voice Numbers",
  "quantity": 1,
  "amount": 24.00,
  "items": [
    { "email": "gv@example.com", "password": "Secure123!", "phone": "+14155550100" }
  ],
  "deliveredAt": "2026-05-30T16:45:00.000Z"
}

const { webhookSecret } = await fetch("https://snappydigits.com/api/user/api-keys", {
  headers: { Authorization: "Bearer sd_live_..." },
}).then((r) => r.json());
// Store webhookSecret server-side — never expose it client-side.

import crypto from "crypto";

// Express / Next.js API route — read the RAW body bytes first!
export async function POST(req) {
  const rawBody = await req.text(); // must be the raw string, not parsed JSON
  const signature = req.headers.get("x-snappy-signature") ?? "";

  const expected = "sha256=" +
    crypto.createHmac("sha256", WEBHOOK_SECRET).update(rawBody).digest("hex");

  // Constant-time comparison to prevent timing attacks
  const valid = signature.length === expected.length &&
    crypto.timingSafeEqual(Buffer.from(signature), Buffer.from(expected));

  if (!valid) return new Response("Forbidden", { status: 403 });

  const event = JSON.parse(rawBody);
  if (event.event === "order.delivered") {
    // Safe to use event.items here
    console.log("Delivered items:", event.items);
  }
  return new Response("OK", { status: 200 });
}

import hmac, hashlib
from flask import Flask, request, abort

app = Flask(__name__)
WEBHOOK_SECRET = "your_webhook_secret_here"  # from GET /api/user/api-keys

@app.route("/webhook/snappy", methods=["POST"])
def handle_webhook():
    raw_body = request.get_data()  # raw bytes — do NOT call request.json() first
    sig = request.headers.get("X-Snappy-Signature", "")

    expected = "sha256=" + hmac.new(
        WEBHOOK_SECRET.encode(), raw_body, hashlib.sha256
    ).hexdigest()

    if not hmac.compare_digest(sig, expected):
        abort(403)

    event = request.get_json()
    if event["event"] == "order.delivered":
        print("Items:", event["items"])

    return "", 200

<?php
$webhookSecret = "your_webhook_secret_here"; // from GET /api/user/api-keys

$rawBody  = file_get_contents("php://input");
$sigHeader = $_SERVER["HTTP_X_SNAPPY_SIGNATURE"] ?? "";
$expected  = "sha256=" . hash_hmac("sha256", $rawBody, $webhookSecret);

if (!hash_equals($expected, $sigHeader)) {
    http_response_code(403);
    exit("Forbidden");
}

$event = json_decode($rawBody, true);
if ($event["event"] === "order.delivered") {
    // Safe to use $event["items"]
    error_log(print_r($event["items"], true));
}

http_response_code(200);
echo "OK";

const API_KEY = "sd_live_your_key_here";
const BASE = "https://snappydigits.com/api/v1";

const res = await fetch(`${BASE}/services`, {
  headers: { Authorization: `Bearer ${API_KEY}` },
});
const { ok, services } = await res.json();
console.log(services);

const res = await fetch(`${BASE}/orders`, {
  method: "POST",
  headers: {
    Authorization: `Bearer ${API_KEY}`,
    "Content-Type": "application/json",
  },
  body: JSON.stringify({ serviceId: "clxyz123", quantity: 2 }),
}).then((r) => r.json());

const { order } = res;
if (order.delivery === "instant" && order.status === "delivered") {
  // Items are ready immediately — no polling required
  console.log("Credentials:", order.items);
  // order.items = [ { email: "...", password: "..." }, ... ]
} else {
  // Manual service — fall through to polling
}

async function waitForDelivery(orderId, maxWaitMs = 300_000) {
  const deadline = Date.now() + maxWaitMs;
  while (Date.now() < deadline) {
    const { order } = await fetch(`${BASE}/orders/${orderId}`, {
      headers: { Authorization: `Bearer ${API_KEY}` },
    }).then((r) => r.json());

    if (order.status === "delivered") return order.items;
    if (order.status === "cancelled") throw new Error("Order cancelled");

    await new Promise((r) => setTimeout(r, 15_000)); // poll every 15s
  }
  throw new Error("Timed out waiting for delivery");
}

const items = await waitForDelivery(order.order.id);
// items is an array of objects — keys vary by service, e.g. { email, password }
// iterate over all keys to display credentials:
for (const account of items) {
  console.log(Object.entries(account).map(([k, v]) => `${k}: ${v}`).join(" | "));
}

import requests, time

API_KEY = "sd_live_your_key_here"
BASE = "https://snappydigits.com/api/v1"
HEADERS = {"Authorization": f"Bearer {API_KEY}"}

# List services
services = requests.get(f"{BASE}/services", headers=HEADERS).json()
svc = services["services"][0]

# Place order
resp = requests.post(
    f"{BASE}/orders",
    json={"serviceId": svc["id"], "quantity": 1},
    headers=HEADERS,
).json()
order = resp["order"]

if order["delivery"] == "instant":
    # Items delivered immediately in the POST response
    print("Credentials:", order["items"])
else:
    # Manual service — poll until delivered
    for _ in range(20):
        result = requests.get(f"{BASE}/orders/{order['id']}", headers=HEADERS).json()
        if result["order"]["status"] == "delivered":
            print("Credentials:", result["order"]["items"])
            break
        if result["order"]["status"] == "cancelled":
            raise Exception("Order cancelled")
        time.sleep(15)

<?php
$apiKey = "sd_live_your_key_here";
$base   = "https://snappydigits.com/api/v1";

function snappyRequest($method, $path, $body = null) {
    global $apiKey, $base;
    $ch = curl_init($base . $path);
    curl_setopt_array($ch, [
        CURLOPT_RETURNTRANSFER => true,
        CURLOPT_HTTPHEADER => [
            "Authorization: Bearer $apiKey",
            "Content-Type: application/json",
        ],
        CURLOPT_CUSTOMREQUEST => $method,
        CURLOPT_POSTFIELDS => $body ? json_encode($body) : null,
    ]);
    return json_decode(curl_exec($ch), true);
}

$services = snappyRequest("GET", "/services");
$resp     = snappyRequest("POST", "/orders", [
    "serviceId" => $services["services"][0]["id"],
    "quantity"  => 1,
]);
$order = $resp["order"];

if ($order["delivery"] === "instant") {
    // Credentials available immediately
    print_r($order["items"]);
} else {
    // Poll for manual delivery
    for ($i = 0; $i < 20; $i++) {
        $result = snappyRequest("GET", "/orders/" . $order["id"]);
        if ($result["order"]["status"] === "delivered") {
            print_r($result["order"]["items"]);
            break;
        }
        sleep(15);
    }
}

You have access to the SnappyDigits Reseller API.
Base URL: https://snappydigits.com/api/v1
Auth header: Authorization: Bearer {API_KEY}

═══ ACCOUNT SERVICES (social accounts, Google Voice, etc.) ═══
  GET  /services              → list account services (id, name, price, stock, delivery)
  POST /orders                → buy account service   body: { serviceId, quantity (max 100) }
  GET  /orders                → list account orders   ?limit=50&cursor=<id>
  GET  /orders/:id            → get single order
  GET  /balance               → USD balance

DELIVERY MODEL — critical, implement correctly:
  - "instant" services: POST /orders returns HTTP 201 with status="delivered" and items[]
    populated immediately. DO NOT poll — credentials are already in the POST response.
  - "manual" services: POST /orders returns status="pending" and items=[].
    Poll GET /orders/:id every 15–30s until status="delivered", then read items[].

items[] is an array of objects. Each object's keys vary per service (e.g. { email, password }
or { email, password, phone } or { details: "..." }). Iterate all keys at runtime.
Never assume a fixed schema. items[] is empty ([]) until status === "delivered".

Error codes: UNAUTHORIZED (401), BAD_REQUEST (400), NOT_FOUND (404),
  INSUFFICIENT_BALANCE (402), OUT_OF_STOCK (409 — service has no stock, retry later),
  CONFLICT (409), RATE_LIMITED (429), SERVICE_UNAVAILABLE (503)

Rate limits: writes (POST) 20/min shared; reads (GET) 60/min per endpoint.

═══ SMM BOOST SERVICES (followers, likes, views, etc.) ═══
  GET  /smm/services          → list SMM services (id, name, category, pricePerThousand, minQty, maxQty)
  POST /smm/orders            → place SMM order   body: { serviceId, link, quantity }
  GET  /smm/orders            → list SMM orders   ?limit=50&cursor=<id>
  GET  /smm/orders/:id        → get single SMM order

Charge formula: charge = pricePerThousand × (quantity / 1000)
  Deducted from balance immediately on order creation.
  quantity must be within minQty–maxQty for the chosen service.

SMM order statuses: pending → processing → completed | partial | cancelled
  - pending:    created but not yet sent to provider
  - processing: provider is fulfilling the order
  - completed:  delivery finished (check startCount + remains)
  - partial:    partially delivered (provider stopped early)
  - cancelled:  order cancelled

SMM order workflow:
  1) GET /smm/services to find service id and pricePerThousand
  2) POST /smm/orders { serviceId, link: "https://...", quantity: 1000 }
  3) Poll GET /smm/orders/:id every 30–60s until status=completed

═══ VIRTUAL NUMBERS (SMS verification) ═══
  GET  /numbers/services      → list services ?server=1|2|3 ?country=usa
  GET  /numbers/countries     → list countries ?server=1|2|3&service=wa
  POST /numbers/orders        → buy number  body: { server, country, service, operator? }
  GET  /numbers/orders        → list number orders ?limit&cursor&status
  GET  /numbers/orders/:id    → get order + sms[] when code arrives
  POST /numbers/orders/:id/cancel → cancel + refund

Servers: 1=fastest/widest coverage, 2=alternative stock, 3=pool-based/bulk
Number order statuses: created/pending/waiting → received/completed (sms[] has code) | expired | cancelled

Number buy workflow:
  1) GET /numbers/services?server=1 to find service code
  2) GET /numbers/countries?server=1&service=wa for country codes
  3) POST /numbers/orders { server:1, country:"usa", service:"wa" }
  4) Poll GET /numbers/orders/:id every 10–20s until status=received
  5) Return sms[0].code to your user
  6) POST /numbers/orders/:id/cancel if user no longer needs it

All responses: { ok: true, ...data } or { ok: false, error: "...", code: "..." }

═══ WEBHOOKS ═══
SnappyDigits sends POST to your webhook URL when a manual order is delivered.
Each request includes: X-Snappy-Signature: sha256=<HMAC-SHA256 of raw body>
Verify before trusting: HMAC-SHA256(rawBody, webhookSecret) must match.
Get webhookSecret from: GET https://snappydigits.com/api/user/api-keys → .webhookSecret
Webhooks are best-effort (no retries). Always poll as a fallback.
Instant-delivery orders do NOT fire a webhook — credentials come in the POST response.