Connect an ERP or app with the Slaby API
Read your products, orders and returns — and optionally issue store credit — from Tally connectors, ERPs, Zapier, or your own scripts, using an API key you create and can revoke any time.
About 10 minutes to create a key; integration time depends on your tool.
Before you start
- Owner or manage-settings access to your Slaby admin. Creating a store-credit (write) key also needs the Edit customers permission.
- A developer or a tool that can send HTTPS requests with an Authorization header.
Step by step
- 1
Create a key with only the scopes you need
In your Slaby admin
Go to Settings → API keys. Give the key a name you will recognise (for example 'ERP sync'), tick the scopes, and click Create key.
The key is shown ONCE. Copy it immediately and store it somewhere safe, like a password manager or your tool's secret settings. Slaby keeps only a fingerprint and can never show it again.
- Catalog (read) — catalog:read
- Orders (read) — orders:read
- Returns (read) — returns:read
- Store credit (read) — store-credit:read
- Store credit (write) — store-credit:write. Moves money; grant sparingly.
- 2
Call the API from your tool
In your tool or code
Send requests to your store's address with the key in the Authorization header. The key decides which store you get, so the same address works with your own domain too.
- 3
Revoke keys you no longer use
In your Slaby admin
On Settings → API keys, each key shows when it was last used. Revoke a key the moment a tool or person no longer needs it — anything using it stops working immediately.
Endpoints
- Header on every request
Authorization: Bearer <your key>- Base address
https://yourstore.slaby.in/api/v1Or your own domain.
- GET /api/v1/products
catalog:read — active products at retail prices. Query: take (≤100), skip, category, search- GET /api/v1/products/{id}
catalog:read — one product- GET /api/v1/orders
orders:read — newest first. Query: take, skip, status- GET /api/v1/orders/{orderNumber}
orders:read — one order with its frozen totals- GET /api/v1/returns
returns:read — return requests. Query: status, cursor, take- GET /api/v1/returns/{id}
returns:read — one return- GET /api/v1/customers/{id}/store-credit
store-credit:read — balance and ledger- POST /api/v1/customers/{id}/store-credit
{"amountMinor":50000,"reason":"Goodwill for late delivery","idempotencyKey":"erp-123"}store-credit:write — amounts are in paise (50000 = ₹500). Re-sending the same idempotencyKey never issues credit twice.
Prices through the API are always retail. Wholesale / trade prices are never returned by the API, whatever the key's scopes. Requests are rate-limited per key — a 429 response includes Retry-After (seconds).
Test it
- 1.From a terminal: curl -H "Authorization: Bearer <your key>" https://yourstore.slaby.in/api/v1/products?take=1 — you should get one product back as JSON.
- 2.The key's Last used column on Settings → API keys updates after a successful call.
If something goes wrong
401 Unauthorized.
Why it happens: The header is missing, misspelled, has extra spaces, or the key was revoked.
How to fix it: Send exactly Authorization: Bearer followed by the key. If the key was lost or revoked, create a new one.
403 'Key lacks the … scope'.
Why it happens: The key was created without the scope this endpoint needs.
How to fix it: Create a new key with the right scopes (scopes cannot be added to an existing key) and revoke the old one.
429 Rate limit exceeded.
Why it happens: Too many requests from one key in a minute.
How to fix it: Wait for the Retry-After seconds, then page through results with take/skip instead of many parallel calls.
Official links
Common questions
- Can the API change my prices or products?
- No. Catalog, orders and returns are read-only. The only write is issuing store credit, and only with a key that has the store-credit:write scope.
- Can someone with a key see my wholesale prices?
- No. Every API request is answered at retail view, so trade prices are structurally absent.
- How do I get notified instead of polling?
- Use webhooks for the moment something happens, then call the API for details.