Manage & keys

Sign in — a magic link, no password

curl -X POST https://gitbuyer.com/auth/magic-link \
  -H "content-type: application/json" \
  -d '{"email": "you@company.com"}'

Click the emailed link, or POST its token to /auth/verify — the response carries a session usable as a Bearer.

API keys

curl -X POST https://gitbuyer.com/my/keys \
  -H "Authorization: Bearer YOUR_SESSION"

The gb_… key is shown once (only its hash is stored) and is a full headless login for every management call. List with GET /my/keys, revoke with DELETE /my/keys/<id> — revocation is immediate.

The management surface

# your stores
curl https://gitbuyer.com/my/stores -H "Authorization: Bearer gb_YOURKEY"

# reprice — only the fields you send change; the old checkout is
# voided so stale links stop selling
curl -X PATCH https://gitbuyer.com/repos/you/your-repo \
  -H "Authorization: Bearer gb_YOURKEY" \
  -H "content-type: application/json" \
  -d '{"price_usd": "40.00"}'

# takedown — the checkout is voided too
curl -X DELETE https://gitbuyer.com/repos/you/your-repo \
  -H "Authorization: Bearer gb_YOURKEY"

The PAT on file follows a three-state contract on updates: absent keeps the saved key, a string replaces it, "" clears it (for a repo that has since gone public).

Sale webhook

curl -X PATCH https://gitbuyer.com/my/account \
  -H "Authorization: Bearer gb_YOURKEY" \
  -H "content-type: application/json" \
  -d '{"webhook_url": "https://your-server.com/hooks/gitbuyer"}'

Every settled sale POSTs there as sale.settled (store, amount, payer, tx hash), signed in X-Gitbuyer-Signature with the secret the call returns — the same t=<unix>,v1=<hmac-sha256 of "t.body"> recipe checkout402's own webhooks use. Send "" to remove it.