Origin Round Partner API

Welcome to the Origin Round Partner API. This Server-to-Server (B2B) integration allows your backend to securely verify, consume, and monitor digital assets (licenses, subscriptions, and items) purchased on Origin Round.

Zero-Trust Rule: Never expose your API keys in a frontend client. All requests must originate from your secure server.

1. The 'Fast Start' Integration Logic

// 1. Send the user's Secret Code to the Origin Round Live /verify endpoint
const originResponse = await verifyAsset(userInputCode);

// 2. Evaluate the Master Switch
if (!originResponse.data.is_valid) {
    // STOP: The asset is expired, refunded, banned, or fake.
    return "Access Denied. Code is invalid or expired."; 
}

// 3. Handle First-Time vs. Returning Users
if (originResponse.data.already_in_use) {
    // SECURITY: This code is valid, but was consumed in the past.
    return "This code has already been claimed."; 
} else {
    // This is a brand new, untouched code! 
    return "Premium Unlocked! Access Granted.";
}

See It In Action (cURL)

Create a Project, Create an Offer (it stays hidden by default), grab your Sandbox key and test code from dashboard, and fire this into your terminal:

curl -X POST https://api.originround.com/api/partners/YOUR_PROJECT_UUID/test \
  -H "Authorization: Bearer or_test_your_api_key" \
  -H "Content-Type: application/json" \
  -d '{"code": "TFRES-HABKN-PKCPF-LGKHG-ELMPL"}'

4. Authentication & Endpoints

Get your API keys from the Developer API tab. Requires Headers: Authorization: Bearer and Content-Type: application/json

5. The Success Payload & Asset Lifecycle

• LOCKED: Newly created and unconsumed. Ready to be claimed or transferred.
• CONSUMED: Successfully redeemed. Cryptography is broken, permanently bound to the user.
• TRANSFER_PENDING: In the middle of a handover. Waiting for new owner to assume billing.
• BLOCKED: Access suspended due to chargeback, fraud flag, or manual revoke.
• EXPIRED: Redemption window closed, or subscription has fully lapsed.

6. Concurrency, Errors & Limits

Race Conditions & Idempotency: Our system uses atomic database locks. If your server accidentally double-fires a consume request simultaneously, only one will succeed. The second safely returns 200 OK with already_in_use: true.

• 400: Bad Request: Invalid data (e.g., trying to consume via a Public Ref, missing a required field).
• 401: Unauthorized: Missing token, or using a TEST key on a LIVE endpoint.
• 403: Forbidden: Your API key was revoked in the Origin Round dashboard.
• 404: Not Found: Check your endpoint syntax. Ensure your project_uuid in the URL is correct.
• 429: Too Many Requests: Limit is 600 requests per minute per API key. Slow down and retry.
• 500: Internal Server Error: An unexpected database error occurred on our side. Safe to retry.
• 503: Service Unavailable: Brief critical maintenance (under 3 minutes). Queue request and retry.

Integration Testing & Payloads

To ensure your integration is robust before going live, write automated tests against the Sandbox Environment. You do not need to mock HTTP requests or spin up fake databases.

const PROJECT_UUID = 'your_project_uuid_here';
const TEST_API_KEY = 'or_test_your_key_here';

const CODES = {
    FRESH:   'TFRES-HABKN-PKCPF-LGKHG-ELMPL',
    USED:    'TUSED-DABKN-PKCPF-LGKHG-ELMPL',
    EXPIRED: 'TEXPR-DABKN-PKCPF-LGKHG-ELMPL',
    BLOCKED: 'TBLOC-KABKN-PKCPF-LGKHG-ELMPL'
};

async function verifyUserAccess(testCode) {
    const response = await fetch(`https://api.originround.com/api/partners/${PROJECT_UUID}/test`, {
        method: 'POST',
        headers: {
            'Authorization': `Bearer ${TEST_API_KEY}`,
            'Content-Type': 'application/json'
        },
        body: JSON.stringify({ code: testCode })
    });
    return await response.json();
}