Connect your commission data to the tools you already use.

Create read-only API keys and signed webhook endpoints in the workspace Developer tools page. Keys are tenant-scoped, permission-scoped, and shown only once. Keep keys in server-side secrets, never in browser code.

Read API

Use only the scopes your integration needs: sales:read and statements:read.

GET /api/v1/external/sales?limit=50&offset=0
GET /api/v1/external/statements
GET /api/v1/external/statement-lines?statementId=<uuid>&limit=50&offset=0

Statement lines are available only after a statement is frozen and omit customer names. Pages allow up to 100 rows. Each API server process rate-limits a key to 120 requests per minute. Requests are tenant-scoped; mutations and payment releases are not available through these keys.

Outgoing webhooks

HTTPS endpoints receive signed events for sales, approvals, disputes, and frozen statements. The X-Commishify-Signature header uses t=timestamp,v1=hex_hmac. Verify HMAC-SHA256 over the timestamp, a period, and the exact raw request body using the endpoint secret. Reject invalid signatures and stale timestamps before processing events.

Deliveries retry with backoff up to eight attempts. Inspect delivery status in Developer tools. Payloads contain record identifiers and event metadata; retrieve authorized details with a scoped key.

TypeScript SDK

The server-side SDK source builds as commishify-sdk, but the npm package has not been published. After registry release, install with npm install commishify-sdk. CommishifyClient supports getSales and getStatements; verifyWebhookSignature checks the raw body, signature header, and endpoint secret.