Manage & keys

Sign in: a magic link, no password

curl -X POST https://gitbuyer.com/auth/magic-link \
  -H "content-type: application/json" \
  -d '{"email": "you@company.com"}'

Click the emailed link, or POST its token to /auth/verify; the response carries a session usable as a Bearer.

API keys

curl -X POST https://gitbuyer.com/my/keys \
  -H "Authorization: Bearer YOUR_SESSION"

The gb_… key is shown once (only its hash is stored) and is a full headless login for every management call. List with GET /my/keys, revoke with DELETE /my/keys/<id>; revocation is immediate.

The management surface

# your inventory (the response's legacy key is "stores")
curl https://gitbuyer.com/my/stores -H "Authorization: Bearer gb_YOURKEY"

# reprice: only the fields you send change; the old checkout is
# voided so stale links stop selling
curl -X PATCH https://gitbuyer.com/repos/you/your-repo \
  -H "Authorization: Bearer gb_YOURKEY" \
  -H "content-type: application/json" \
  -d '{"price_usd": "40.00"}'

# takedown: the checkout is voided too
curl -X DELETE https://gitbuyer.com/repos/you/your-repo \
  -H "Authorization: Bearer gb_YOURKEY"

The PAT on file follows a three-state contract on updates: absent keeps the saved key, a string replaces it, "" clears it (for a repo that has since gone public).

Storefront tagline

curl -X PATCH https://gitbuyer.com/my/account \
  -H "Authorization: Bearer gb_YOURKEY" \
  -H "content-type: application/json" \
  -d '{"storefront_tagline": "I build Django starters"}'

One line of voice at the top of your public storefront (/r/<owner>): plain text, 140 characters. Same three-state contract: absent keeps, "" clears. It shows once the owner name ties to your account: your GitHub connection, or being the only account listing under that owner.

Sale webhook

curl -X PATCH https://gitbuyer.com/my/account \
  -H "Authorization: Bearer gb_YOURKEY" \
  -H "content-type: application/json" \
  -d '{"webhook_url": "https://your-server.com/hooks/gitbuyer"}'

Every settled sale POSTs there as sale.settled (repo, amount, payer, tx hash), signed in X-Gitbuyer-Signature with the secret the call returns, the same t=<unix>,v1=<hmac-sha256 of "t.body"> recipe checkout402's own webhooks use. Send "" to remove it. Delivery retries for about thirty seconds, then stops: the webhook is a prompt notification, and your dashboard is the ledger of record. A sale whose delivery failed still shows there, backfilled automatically.