Authentication
All API requests are authenticated with a secret key sent as a Bearer token. Keys are scoped and can be revoked at any time from the dashboard. Keep them server-side — never ship a key in client code.
curl https://blisslyng.com/api/v1/me \
-H "Authorization: Bearer bl_live_xxxxxxxxxxxxxxxx"Scopes
A key only grants the scopes you select when creating it:
| Scope | Grants |
|---|---|
links:read | List your short links |
links:write | Create short links |
orders:read | List your storefront orders |
Endpoints
Base URL: https://blisslyng.com/api/v1. All responses are JSON.
| Method | Path | Description |
|---|---|---|
| GET | /me | Your account profile & plan |
| GET | /links | List your short links (links:read) |
| POST | /links | Create a short link (links:write) |
| GET | /orders | List storefront orders (orders:read) |
Example — create a link
curl -X POST https://blisslyng.com/api/v1/links \
-H "Authorization: Bearer bl_live_xxxxxxxxxxxxxxxx" \
-H "Content-Type: application/json" \
-d '{"url":"https://example.com/my-page","slug":"launch"}'Webhooks
Register an HTTPS endpoint in the dashboard to receive events as they happen. Each delivery is a POST with a JSON body and these headers:
| Header | Value |
|---|---|
X-BlissLyng-Event | The event name, e.g. order.paid |
X-BlissLyng-Signature | HMAC-SHA256 of the raw body, signed with your webhook secret |
Events
order.created · order.paid · order.shipped · order.delivered · product.reviewed · page.viewed
Verifying the signature
Recompute the HMAC over the exact raw request body and compare in constant time:
$expected = hash_hmac('sha256', $rawBody, $yourWebhookSecret);
if (! hash_equals($expected, $request->header('X-BlissLyng-Signature'))) {
abort(403); // reject — not from BlissLyng
}Sample payload
{
"id": "evt_ab12cd34ef56",
"event": "order.paid",
"data": {
"reference": "BL-XXXX",
"order_number": "ORD-1024",
"tracking": null
}
}Need a hand?
Email developers@blisslyng.com or check the live status page. Webhooks are available on the Agency plan.