EVI Partner API

Integrate EVI activation into your own site or app. You buy EVI codes from us and sell them to your users; they redeem them through this API — including the Stripe payment verification when it is required.

To get started you only need an API key — request it from us. Everything else is below.

Base URL & auth

Base URL: https://api.evishopai.com/v1. Call it only from your server — your users' devices talk to your backend, and your backend talks to this API. Currently supported: ChatGPT (Plus / Go / Pro). More products arrive in later versions.

Authorization: Bearer evi_live_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

Response format

Success returns { "data": { … } }; failure returns a stable code plus a human message:

// success
{ "data": { "status": "valid" } }

// failure (HTTP 4xx/5xx)
{ "code": "cdk_not_found", "message": "Code not found" }

Branch on code, not on message. 401 = bad key · 404 = code not found · 409 = state conflict · 429 = rate limited · 5xx = retry later.

Flow

1. POST /verify — check the code is valid and unused.
2. Collect the user's ChatGPT session (full JSON from chatgpt.com/api/auth/session, personal account on the free plan, no active subscription).
3. POST /redeem with code + session_info.
4. Poll GET /orders/{code} until status is done or failed.
5. If a poll returns a customerAction, run the Stripe step in the user's browser, then keep polling. Only done means delivered.

Endpoints

GET/config

Capabilities and available products.

{ "data": { "customerActionSupported": true, "products": [ { "id": 4, "name": "ChatGPT Plus — 1 month" } ] } }

POST/verify

Body { "code": "EVI-XXXX-XXXX-XXXX-XXXX" }. Returns status: valid · used · invalid.

{ "data": { "status": "valid", "product": { "name": "ChatGPT Plus — 1 month" } } }

POST/redeem

Body { "code", "session_info" }. session_info is the full account session JSON (string) — used only for this activation, never stored, mask it in your logs. We check the token live first; an expired / invalid / already-subscribed account is rejected without consuming the code.

{ "data": { "id": "EVI-XXXX-XXXX-XXXX-XXXX", "status": "processing", "message": "Activation started…" } }

GET/orders/{code}

status: done · processing · failed. customerAction appears only while a Stripe check is pending (disappearing ≠ success).

{ "data": { "id": "EVI-…", "status": "processing", "customerAction": { "type": "stripe_next_action", "actionId": "…", "expiresAt": 1788994694219 } } }

POST/cdk-status

Body { "code" } → { "data": { "state": "unused" | "processing" | "done" } }.

POST/customer-action/{start|complete|recheck}

Stripe verification proxy — see the next section.

Stripe payment verification

Some activations need the end user to complete a Stripe check (captcha / 3-D Secure). It only happens when /orders/{code} returns a customerAction. The check runs in the user's browser with official Stripe.js. Your backend forwards start / complete / recheck to us with your key and the code — we add the payment identifiers server-side; you and the browser never send them. Never log clientSecret.

Browser helper (.mjs)Node backend + redeem example

Notes & limits

Keep the API key on your server only. If it leaks, ask us to rotate it.
Never log session_info, clientSecret, or full request bodies.
Rate limits per key/min: verify 120 · redeem 60 · orders 120 · cdk-status 120 · customer-action 20.
Poll active orders ~every 5s; the order status is the only proof of delivery.

curl

curl https://api.evishopai.com/v1/config -H "Authorization: Bearer evi_live_xxx"

curl -X POST https://api.evishopai.com/v1/redeem \
  -H "Authorization: Bearer evi_live_xxx" -H "Content-Type: application/json" \
  -d '{"code":"EVI-XXXX-XXXX-XXXX-XXXX","session_info":"{\"accessToken\":\"ey...\"}"}'