Shop data, scoped to staff
The CardCounter POS Workspace API lives on the CardCounter POS website under /api/v1. It reads authorized shop data through a signed-in staff session or a scoped shop API key, and respects organization and location permissions.
Use the published contract
Open the Workspace OpenAPI contract for the current routes, parameters, response envelopes, and errors. Its authentication model is separate from the standalone Market Data API at https://pokepos-market-api.vercel.app.
Workbench
Open Developers at the bottom of your shop workspace. Inspect requests, filter errors, read audit logs, and manage signed event deliveries. Shop owners can manage shop API keys in Settings → API & keys or the Workbench; managers can review activity.
Supported events are system.test and shop.profile.updated. Add a public HTTPS endpoint in Webhooks, save its signing secret, and send a connection test. The profile event contains the revision and changed field names, without profile values.
Verify CardCounterPOS-Signature using HMAC-SHA256 with your endpoint secret over the timestamp, a dot, and the raw request body. The header contains t=timestamp,v1=hex-signature. Compare signatures in constant time, reject timestamps more than five minutes old, and deduplicate by event ID before processing. Return a 2xx response promptly.
Hosted delivery runs on a minute schedule with up to five automatic attempts. Retries are at least once; a timeout can mean your receiver accepted an event before the response was lost. Workbench retains bounded request metadata and never logs API credentials or response bodies.
Market pricing in the workspace
The Market Pricing Add-on uses the signed-in shop workflow to show observed prices beside a selected SKU. API plan keys are for external integrations and do not grant access to CardCounter POS shop records.
Read about the add-on