Base URL
- Production API base URL:
https://api.ongapi.com - REST prefix:
/v1(all documented paths start with/v1/…)
Send your API key on every request to that host:
GET /v1/orders HTTP/1.1
Host: api.ongapi.com
Authorization: Bearer ong_test_... or ong_live_...
Or with curl:
curl -sS "https://api.ongapi.com/v1/orders?limit=1" \
-H "Authorization: Bearer ong_test_..."
Platform OAuth redirects and marketplace push URLs remain registered on https://ongapi.up.railway.app (same API service, alternate hostname).
Use test keys against Sandbox and mock connections. Use live keys only after billing is active. Keys are shown once at creation. Ongapi stores a hash only.
Keys and connections
| Key prefix | Use for |
|---|---|
ong_test_… | Sandbox: mock connections, test webhooks, GET /v1/orders on mock data |
ong_live_… | Production shops after a paid plan is active |
With a test key, POST /v1/connections/authorize always starts mock OAuth, even if the JSON body names a live marketplace platform.
With a live key, the same endpoint starts real Shopee, TikTok Shop, Lazada, or Shopify OAuth. After the seller approves, Ongapi redirects to your return_url with connection_id and status=active on success, or status=error and error on failure. Load platform, platform_shop_id, and status with GET /v1/connections/{connection_id}.
Request fields, authorize_url, and redirect query parameters are documented in Platforms and OAuth.
Rate limits apply per API key. If you receive HTTP 429, back off and retry with exponential delay. Do not share keys in client-side code or public repositories.