The systems around your store, in on it.

Authentication

Create a key in Settings → Developers and send it as a bearer token. It is shown once; PalletRow keeps only a fingerprint of it.

curl https://app.palletrow.com/api/v1/products/{id} \
  -H "Authorization: Bearer prk_live_…"

Limits and errors

120 requests a minute per key. Every error is JSON with a sentence in message — never a redirect to a sign-in page.

The reference

An OpenAPI 3.1 document, generated on every deploy from the same schemas the endpoints validate against — so it cannot describe a field the API does not take. Load it into Postman, Insomnia or a client generator.

app.palletrow.com/api/v1/openapi.json

Every endpoint lists the permission it needs, and each webhook event is described in the document’s webhooks section.

Webhooks

Add an https endpoint in Settings → Developers, choose events, and PalletRow POSTs a signed JSON envelope within seconds of each change.

POST /your/endpoint HTTP/1.1
Content-Type: application/json
User-Agent: PalletRow-Webhooks/1.0
PalletRow-Event-Id: evt_3f9c2a71d04b8e6a5c1d0f27
PalletRow-Event-Type: sale.created
PalletRow-Signature: t=1759190400,v1=6b1f…(64 hex)

{
  "id": "evt_3f9c2a71d04b8e6a5c1d0f27",
  "type": "sale.created",
  "created": "2026-09-30T14:00:00.000Z",
  "organization_id": "9d2c…",
  "data": {
    "sale_id": "…",
    "location_id": "…",
    "source": "square",
    "external_id": "Rk3…",
    "is_refund": false,
    "subtotal": "42.1800",
    "tax_total": "2.9000",
    "total": "45.0800",
    "line_count": 6,
    "unmatched_line_count": 0,
    "transacted_at": "2026-09-30T13:59:41.000Z"
  }
}

Verifying a delivery

PalletRow-Signature is t=<unix seconds>,v1=<hex>, where v1 is the HMAC-SHA256 of <t>.<raw body> under the endpoint’s whsec_ secret. Reject a timestamp more than five minutes old, and compare in constant time.

import { createHmac, timingSafeEqual } from 'node:crypto';

// Use the RAW request body — the exact bytes received, before JSON.parse.
export function verifyPalletRow(rawBody, header, secret, toleranceSeconds = 300) {
  const parts = Object.fromEntries(
    header.split(',').map((kv) => kv.trim().split('=', 2)),
  );
  const t = Number(parts.t);
  if (!Number.isInteger(t) || !parts.v1) return false;
  if (Math.abs(Date.now() / 1000 - t) > toleranceSeconds) return false;

  const expected = createHmac('sha256', secret).update(`${t}.${rawBody}`).digest();
  const given = Buffer.from(parts.v1, 'hex');
  return given.length === expected.length && timingSafeEqual(given, expected);
}

// Express, for example:
app.post('/palletrow', express.raw({ type: 'application/json' }), (req, res) => {
  const ok = verifyPalletRow(
    req.body.toString('utf8'),
    req.get('PalletRow-Signature') ?? '',
    process.env.PALLETROW_WEBHOOK_SECRET,
  );
  if (!ok) return res.status(400).end();

  const event = JSON.parse(req.body);
  // Deduplicate on event.id — a retry or a resend carries the same one.
  res.status(204).end();
});

Rotating the secret in settings takes effect on the next attempt, retries included. Use “Send test event” to check a receiver end to end.