Pocketsflow API Quickstart: Your First Request in 5 Minutes

To start with the Pocketsflow API, create an API key under Developers → API keys in the Pocketsflow dashboard, then send it as Authorization: Bearer pk_test_… to https://api.pocketsflow.com. Pocketsflow answers in JSON, and your first useful call is POST /checkout/sessions, which returns a hosted checkout link you send a buyer to.

This guide covers the key, the first request with curl and with the pocketsflow SDK, the rate limit, the errors, and where the full reference lives. Every endpoint and snippet below comes from the Pocketsflow docs.

Step by step: your first Pocketsflow API call

1. Sign in to Pocketsflow and set a store subdomain. Checkout links live on it, so POST /checkout/sessions needs it first.
2. Create at least one product, in test mode while you build.
3. Open Developers → API keys and create a key. Copy it into an environment variable such as POCKETSFLOW_API_KEY.
4. Call GET /users/me to check the key works.
5. List your products with GET /products, then create a checkout session for one of them.

Pocketsflow test keys vs live keys

Pocketsflow API keys come in two kinds, and the key decides the mode. A pk_test_… key always reads and writes test data, and a pk_live_… key always reads and writes live data, whatever the test mode switch in the dashboard says.

GET /users/me tells you which mode a key is in through its testMode field. Keep keys on your server, never in browser code, a mobile app or a public repository. A revoked or expired key answers 401.

Base URL and auth header for the Pocketsflow API

Every Pocketsflow request goes over HTTPS to https://api.pocketsflow.com. There is no version prefix: you call GET /orders, not /v1/orders. The API is unversioned and changes are additive, so ignore fields you don't know. The first call checks the key:

curl https://api.pocketsflow.com/users/me \
  -H "Authorization: Bearer pk_test_xxxxxxxxxxxxxxxxxxxxxxxx"

Send JSON bodies with Content-Type: application/json. Money in Pocketsflow requests and responses is a decimal in major units, so 12.1 means $12.10. Only fields whose name ends in Cents are whole cents.

List products and create a checkout session with curl

GET /products returns your whole Pocketsflow catalog in one array, with no paging:

curl https://api.pocketsflow.com/products \
  -H "Authorization: Bearer pk_test_xxxxxxxxxxxxxxxxxxxxxxxx"

Take a product _id and create a hosted checkout. Only productId is required, and it can be a one time product or a subscription offer:

curl https://api.pocketsflow.com/checkout/sessions \
  -H "Authorization: Bearer pk_test_xxxxxxxxxxxxxxxxxxxxxxxx" \
  -H "Content-Type: application/json" \
  -d '{
    "productId": "665f1c2a9b3e4a0012ab34cd",
    "successUrl": "https://acme.com/thanks",
    "cancelUrl": "https://acme.com/pricing",
    "customerEmail": "buyer@example.com"
  }'

Pocketsflow answers with:

{ "id": "cs_…", "url": "https://<store>.pocketsflow.com/checkout?…" }

Redirect the buyer to url. Optional fields are lockEmail, clientReferenceId, discountCode and metadata, an object that comes back on the resulting webhooks. A productId that isn't yours answers 404.

The same calls with the pocketsflow SDK

The official Node.js and TypeScript package is pocketsflow on npm. Install it with npm install pocketsflow and run it on your server only.

import { Pocketsflow } from "pocketsflow";

const pocketsflow = new Pocketsflow({
  apiKey: process.env.POCKETSFLOW_API_KEY!,
  baseUrl: "https://api.pocketsflow.com",
});

const products = await pocketsflow.products.list();

const session = await pocketsflow.checkout.create({
  productId: products[0]._id,
  successUrl: "https://example.com/welcome",
  cancelUrl: "https://example.com/pricing",
  customerEmail: "buyer@example.com",
  metadata: { plan: "pro" },
});

// Redirect the buyer to session.url.
console.log(session.url);

The SDK's checkout.create type requires successUrl and cancelUrl, while the raw HTTP API only requires productId. SDK calls reject on any non-2xx answer, so wrap them in try and catch.

What a Pocketsflow checkout session sale leaves you

A buyer who pays through a Pocketsflow checkout session pays the Pocketsflow fee of 4.7% + $0.30 per sale, as of November 2026, with no monthly fee. Pocketsflow is the merchant of record, so it also handles sales tax and VAT. A $9 sale leaves you $8.28 and a $99 sale leaves you $94.05.

Pocketsflow API rate limits

Pocketsflow allows 600 requests a minute per account when you send a valid API key. Traffic without a valid key shares 200 requests a minute per IP address, so always send your key. Each response carries RateLimit-Limit, RateLimit-Remaining and RateLimit-Reset. Over the limit, Pocketsflow answers 429 with a Retry-After header in seconds: wait that long, then retry.

Pocketsflow API errors

Pocketsflow errors use normal HTTP status codes and a JSON body. Read message first, fall back to error, and branch on code when it is there.

• 400: bad JSON, a bad id or a failed check.
• 401: a missing, malformed, expired or revoked key.
• 403: not allowed. FEATURE_LOCKED means the feature needs a higher plan; retrying fails the same way.
• 404: not found, not yours, or from the other mode.
• 429: rate limited. 500 and 502: retry reads with backoff.

To avoid FEATURE_LOCKED, call GET /users/entitlements before you turn on a paid feature such as upsells. The API, checkout sessions and webhooks themselves work on every Pocketsflow plan.

Where the full Pocketsflow API reference lives

The interactive Pocketsflow reference is at api.pocketsflow.com/docs, where you can try each endpoint live. The raw OpenAPI file is at https://api.pocketsflow.com/docs.json; load it into Postman or a code generator. The developers page sums up the API, the SDK and webhooks.

Next: Pocketsflow webhooks

A checkout session tells you where to send the buyer, but a Pocketsflow webhook tells you the sale happened. Read Pocketsflow webhooks explained to receive order.completed and verify its signature. If you are choosing between code and an AI agent, read MCP vs API for selling online.