Reseller API

Quickstart

1. 1. Create an API key

   Once your reseller account is approved, create a key in your dashboard. A prk_live_ key places real orders; a prk_test_ key is a sandbox that charges nothing and produces nothing. The full key is shown only once.

2. 2. Get a quote

   POST /quotes with lines and the destination country returns your price including discount, VAT and shipping.

3. 3. Place an order

   POST /orders with an Idempotency-Key header (for example your own order number). Retrying with the same key never creates a second order.

4. 4. Receive webhooks

   Register an https endpoint and receive status changes, such as shipped with tracking.

# Product: customer options with defaults and allowed values (id or any slug)
curl https://www.printen.eu/api/reseller/v1/products/flyers?lang=en \
  -H "Authorization: Bearer prk_test_..." -H "User-Agent: MyShop-Integration/1.0"

# Prijs / quote: only customer options; omitted options get the product-page default.
# quantity = number of pieces (for run-priced products the run: here 1000 flyers)
curl -X POST https://www.printen.eu/api/reseller/v1/quotes \
  -H "Authorization: Bearer prk_test_..." -H "Content-Type: application/json" \
  -H "User-Agent: MyShop-Integration/1.0" \
  -d '{"country":"BE","lines":[{"productId":"<product id>","quantity":1000,"options":{"size":"a5","material":"135gr_gesatineerd_mc","printtype":"44"}},{"resellerSku":"POSTER-A2","quantity":1}]}'

# Order
curl -X POST https://www.printen.eu/api/reseller/v1/orders \
  -H "Authorization: Bearer prk_test_..." -H "Content-Type: application/json" \
  -H "Idempotency-Key: shop-order-1001" \
  -d '{"externalOrderId":"1001","lines":[{"resellerSku":"POSTER-A2","quantity":1,"fileUrl":"https://example.com/design.pdf"}],
       "recipient":{"name":"Anna de Vries","email":"anna@example.com","phone":"+31612345678","address1":"Dorpsstraat 1","postalCode":"1234 AB","city":"Utrecht","country":"NL"}}'

# Webhook
curl -X POST https://www.printen.eu/api/reseller/v1/webhooks \
  -H "Authorization: Bearer prk_live_..." -H "Content-Type: application/json" \
  -d '{"url":"https://example.com/printen-webhook","events":["order.shipped","order.delivered"]}'

Authentication

Send your key as Authorization: Bearer prk_live_... Keys can have scopes; a key without scopes may do everything.

With a prk_test_ key, orders are created but not charged and not sent to production.

Up to 120 requests per minute per key, plus account budgets for quotes and orders. Every response carries RateLimit-Limit, RateLimit-Remaining and RateLimit-Reset (seconds) for the strictest limit that applies; above it you get 429 with a Retry-After header.

Base URL: https://www.printen.eu/api/reseller/v1

Endpoints

How the API works

Webhooks

We POST JSON to your endpoint with the headers X-Printen-Event, X-Printen-Delivery, X-Printen-Timestamp and X-Printen-Signature. Respond with a 2xx status within 10 seconds. If that fails, we retry for about 24 hours. An event can arrive more than once: dedupe on the id field.

Events

• order.created
• order.submitted
• order.awaiting_funds
• order.payment_failed
• order.in_production
• order.shipped
• order.delivered
• order.cancelled
• order.file_problem

Verifying the signature

X-Printen-Signature is v1= followed by the hex HMAC-SHA256 of "timestamp.raw body" using your endpoint secret. Reject messages with a timestamp older than 5 minutes.

Node.js

import crypto from 'node:crypto';

export function verifyPrintenWebhook(rawBody, headers, secret) {
  const timestamp = headers['x-printen-timestamp'];
  const signature = headers['x-printen-signature'] || '';
  if (Math.abs(Date.now() / 1000 - Number(timestamp)) > 300) return false;
  const expected = 'v1=' + crypto.createHmac('sha256', secret)
    .update(`${timestamp}.${rawBody}`).digest('hex');
  return signature.length === expected.length
    && crypto.timingSafeEqual(Buffer.from(signature), Buffer.from(expected));
}

PHP

<?php
function verify_printen_webhook(string $rawBody, string $timestamp, string $signature, string $secret): bool {
    if (abs(time() - (int) $timestamp) > 300) return false;
    $expected = 'v1=' . hash_hmac('sha256', $timestamp . '.' . $rawBody, $secret);
    return hash_equals($expected, $signature);
}

Python

import hashlib, hmac, time

def verify_printen_webhook(raw_body: bytes, timestamp: str, signature: str, secret: str) -> bool:
    if abs(time.time() - int(timestamp)) > 300:
        return False
    expected = "v1=" + hmac.new(secret.encode(), timestamp.encode() + b"." + raw_body, hashlib.sha256).hexdigest()
    return hmac.compare_digest(expected, signature)

Errors

Every error has the shape {"error": {"code": "...", "message": "...", "details": [...]}}. 400 = malformed request; 422 = valid request that cannot be fulfilled (see details); 401, 403, 404, 409 and 429 as usual; 500 only for a failure on our side. Amounts are always in euro cents.