> For the complete documentation index, see [llms.txt](https://docs.driffle.com/driffle-seller-api-legacy/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.driffle.com/driffle-seller-api-legacy/guide/getting-started.md).

# Getting Started

This guide will guide you through the basics of the usage of our API. By the end of reading through this guide you will be equipped by the knowledge of how to implement API requests to any of your endpoints.

## Recommended Tools

For development purposes we recommend any tool that supports REST API exploration, here are a few of them:

* [Postman](https://www.postman.com/)
* [Insomnia](https://insomnia.rest/products/insomnia)
* [Altair](https://altairgraphql.dev/)

## Environments in Driffle API

Driffle API currently provides  `production`  environment at the moment. Please use the following base URL while making HTTP requests:

{% tabs %}
{% tab title="Production" %}

> <https://services.driffle.com/api/seller/legacy>
> {% endtab %}
> {% endtabs %}

{% hint style="warning" %}
We will have a dummy product to test your integration. The dummy product  will not be visible to the users & is private to you only.
{% endhint %}

{% hint style="success" %}
Please Note that this API documentation is actively managed and supported **indefinitely**.
{% endhint %}

## Getting Access

You need to generate an API Key to gain access. Driffle APIs uses authorization mechanism with `Bearer` tokens.&#x20;

### 1. Generating an API Key

You can get your credentials from the [Driffle dashboard](https://driffle.com/user/selling/dashboard). You will need to go to the seller dashboard and click on the `API settings` page. On this page, you will be able to create a new API key.

<figure><img src="/files/KRcIU4RcAHADx1ENlAF1" alt=""><figcaption></figcaption></figure>

### 2. Authorization

Once you have generated an API Key, you need to get an `access_token` . To get it, you will have to use the `API Key` you got in the "Generating an API Key" step above.

The following describes how you can get an access token for `production` environment:

<mark style="color:green;">`POST`</mark> [/token](https://services.driffle.com/api/seller/legacy/token)

Creates a token from an API Key. This token is then used to authorize further API calls.

**Headers**

| Name         | Value              |
| ------------ | ------------------ |
| Content-Type | `application/json` |

**Body**

| Name   | Type   | Description                              | Required |
| ------ | ------ | ---------------------------------------- | -------- |
| apiKey | string | The API key provided for authentication. | Yes      |

**Response**

{% tabs %}
{% tab title="200" %}

```json
{
  "message": "string",
  "statusCode": 200,
  "data": {
    "token": "string"
  }
}
```

{% endtab %}

{% tab title="400" %}

```json
{
    "message": "Bad Request. Wrong/Invalid params format.",
    "statusCode": 400 
}
```

{% endtab %}

{% tab title="401" %}

```json
{
    "message": "UnAuthorized request. Invalid/Expired token",
    "statusCode": 401
}
```

{% endtab %}

{% tab title="403" %}

```json
{
    "message": "Forbidden Request. Action not allowed or Rate Limit exhausted.", 
    "statusCode": 403
}
```

{% endtab %}

{% tab title="500" %}

<pre class="language-json"><code class="lang-json">{
    "message": "Internal Server Error",
<strong>    "statusCode": 500
</strong>}
</code></pre>

{% endtab %}
{% endtabs %}

#### Example Request

Take a look at the following sample request on how you might call this method using `curl` , `NodeJS` and `PHP`:

{% tabs %}
{% tab title="curl" %}

```bash
curl -X POST https://services.driffle.com/api/seller/legacy/token \
--header 'Content-Type: application/json' \
--data '{
    "apiKey": "226c911a60d9eb4395782456b7488c44.b8e6204d08def735b5084ced36596986512a2578772b42b8998847276d0de9a6"
}'
```

{% endtab %}

{% tab title="Node" %}

```javascript
const axios = require("axios")
const url = "https://services.driffle.com/api/seller/legacy/token"
const response = await axios.post(url, {
    apiKey: "226c911a60d9eb4395782456b7488c44.b8e6204d08def735b5084ced36596986512a2578772b42b8998847276d0de9a6",
})
const data = response.data
console.log(data)
```

{% endtab %}

{% tab title="PHP" %}

```python
<?php

$curl = curl_init();

curl_setopt_array($curl, array(
  CURLOPT_URL => 'https://services.driffle.com/api/seller/legacy/token',
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => '',
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 0,
  CURLOPT_FOLLOWLOCATION => true,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => 'POST',
  CURLOPT_POSTFIELDS =>'{
    "apiKey": "226c911a60d9eb4395782456b7488c44.b8e6204d08def735b5084ced36596986512a2578772b42b8998847276d0de9a6"
}',
  CURLOPT_HTTPHEADER => array(
    'Content-Type: application/json'
  ),
));

$response = curl_exec($curl);

curl_close($curl);
echo $response;
```

{% endtab %}
{% endtabs %}

#### Example Response

The above request responded with following response:

```json
{
    "statusCode": 200,
    "message": "Successfull generated token",
    "data": {
        "token": "eyJhbGciOiJIUzUxMiIsInR5cCI6IkpXVCJ9.eyJ1c2VySWQiOjYzLCJzdG9yZUlkIjoyOSwiYWxsb3dlZEZlYXR1cmVzIjp7InZhdCI6dHJ1ZX0sImlhdCI6MTY5MTEzMTU3MCwiZXhwIjoxNjkxMTMzMzcwfQ.05nxjyq7RtX4cQDTaBpcvM50ZmDQdaM0jMTINbOBaYi251592eAHytBWbE1LhriVAhjeT-S5_hjMMlXYfUtxtA"
    }
}
```

### 3. Using the access token

All requests to our REST API must contain a `Bearer` access token in the `Authorization` HTTP header. Use the `access_token` you acquired in [#2.-authorization](#2.-authorization "mention") as follows:

```http
Authorization: Bearer <access_token>
```

{% hint style="warning" %}
The acquired `access_token` is temporary and will expire after **30 minutes**. You will need to regenerate the access\_token as mentioned in [#2.-authorization](#2.-authorization "mention") to keep the API implementation secure.
{% endhint %}

## Rate Limiting

To protect internal systems, Driffle API implements rate-limiting. There are two types of rate-limiting strategies - `global` and `action`.

### 1. Global Limits

Your IP address is limited to `4000 requests per 10 min`.

### 2. Action Limits

Some actions are protected by specific limits:

| Action                           | Endpoint            | Rate limit              |
| -------------------------------- | ------------------- | ----------------------- |
| Update offer price               | /offer/update-price | 1 request per 3 seconds |
| Toggle Offer i.e. enable/disable | /offer/toggle       | 1 request per 3 seconds |
| Access Token generation          | /token              | 2 requests per 1 minute |
| Update Offer                     | /offer/update       | 1 request per 3 seconds |
| Bulk Update Offers               | /offer/bulk-update  | 1 request per 5 seconds |

Rate Limiting Headers In Response -

> RateLimit-Remaining\
> RateLimit-Limit