Getting started
Create an API key from Dashboard → Developer API. The complete secret appears only once. Include it as a Bearer token over HTTPS.
curl https://YOUR_DOMAIN/api/v1/products \ -H "Authorization: Bearer nd_drop_live_..."
Products
Read products with GET /api/v1/products; create with POST /api/v1/products; edit with PATCH /api/v1/products/:id. Required fields are title, cost, price, and stock.
const response = await fetch("https://YOUR_DOMAIN/api/v1/products", {
headers: { Authorization: `Bearer ${process.env.NODEDISTRO_API_KEY}` }
});
const { data } = await response.json();Stores, orders, and analytics
GET /api/v1/stores, GET /api/v1/orders, and GET /api/v1/analytics expose workspace records for keys with the corresponding scopes. Store connection requires a separate authorized provider flow.
AI generation
POST /api/v1/ai/generate accepts feature, prompt, idempotency_key (UUID), and optional model (UUID). It requires ai:generate scope and a configured eligible provider. Usage counts against the current plan.
Scopes and errors
Supported scopes include products:read, products:write, orders:read, stores:read, analytics:read, ai:generate, suppliers:read, automations:read, automations:write, and webhooks:manage. Errors use JSON and standard 4xx or 5xx responses. Requests are rate limited per workspace.
Webhooks
Register HTTPS endpoints from Dashboard → Developer API or POST /api/v1/webhooks. Product created, updated, and published events are signed with HMAC-SHA256 over timestamp.body. Read the X-NodeDistro-Timestamp and X-NodeDistro-Signature headers, reject old timestamps, and compare signatures in constant time. The signing secret appears only once.
Project setup
For a new deployment, apply the SQL migration to a dedicated Supabase project, set the environment variables in .env.example, configure Supabase Auth redirect URLs, add allowed Google and GitHub providers if desired, add Stripe prices and a webhook endpoint, then deploy to Vercel. Set server secrets in Vercel, never in browser code.