Selling keys

How it works

A store webhook is a URL you paste into your store. When someone buys, the store calls it, SantiAuth checks the signature, generates the keys and answers with them — one key per line — so the store can hand them to the buyer as the delivered product.

Supported stores:

Setting up

1. Open Webhooks → Store webhooks and press New webhook.
2. Give it a name (e.g. SellAuth main store) and pick the Store.
3. Copy the Signing secret — it is generated for you — and paste it into your store's webhook / dynamic-delivery settings.
4. Copy the webhook URL and paste it into the same place in your store. It looks like:

https://api.santiauth.com/api/v1/webhooks/execute/<webhook-id>

1. Optionally turn on Refund handling.
2. Press Test webhook — it sends a signed test event through the same pipeline as real deliveries. You should see the generated keys in the response.

Quantity

The number of keys is read from the payload field item.quantity (1 when missing, at most 100 per delivery). A buyer who orders 3 gets 3 keys.

Which keys are issued

Keys are created from your service's provider (or the provider set in provider_id). A webhook made in the dashboard issues Standard, lifetime keys. To change that, update the webhook's action_config through the API — see Update a webhook and the action_config fields:

Custom stores

Pick Custom for any store that can send a signed JSON webhook:

• The signature is HMAC(secret, raw request body) as hex, sent in X-Custom-Signature — a sha256= style prefix is accepted. The header name and algorithm (SHA1, SHA256, SHA512) can be changed through the API.
• Conditions (API) let you skip deliveries that aren't sales of this product. Each condition checks a payload field with equals, contains, regex, exists, greater_than or less_than, combined with AND / OR groups. A skipped delivery returns 204 and generates nothing.

Refunds and chargebacks

Turn on Refund handling on a webhook to revoke an order's keys when the store reports a refund or chargeback:

• Order ID field — JSON path to the order id in the payload (e.g. id or data.uniqid). Every issued key is linked to it.
• Refund rule — a field, an operator and a value (e.g. event equals refund). Deliveries matching it revoke that order's keys instead of issuing new ones.
• Ban holders — optionally also ban the Discord account and bound HWID of those keys.

A refund delivery answers 200 with JSON instead of keys:

{ "event": "refund", "order_id": "A1B2C3", "reason": "...", "order_found": true, "revoked": 3, "not_found": 0 }

Responses

Logs and retries

Delivery logs on each webhook show every request: the sent body, the response and the generated keys. Failed deliveries are retried automatically up to 10 times with exponential backoff (from 30 seconds up to 1 hour between tries).