Docs & API

Everything you can build on top of EntryRate — REST API, webhooks, an embeddable widget, and JavaScript SDK. Stable from v3.0; semver from there on.

Quickstart

Every promoter account gets an API key in the dashboard at Settings → API keys. Authenticate every request with a Bearer token. Production base URL:

// Base URL
https://api.entryrate.co.uk/v1

// First request
curl https://api.entryrate.co.uk/v1/events \
  -H "Authorization: Bearer er_live_••••••••"

Authentication

All endpoints require a Bearer token. Keys are scoped per-promoter; admin scopes available for multi-promoter agencies on the Network tier.

Errors & rate limits

Standard HTTP status codes. Errors return JSON with a stable code and a human message.

{
  "error": {
    "code":    "event.tier_oversold",
    "message": "Tier 'Early bird' has 0 left.",
    "docs":    "https://entryrate.co.uk/docs#errors"
  }
}

Rate limits: 200 req / 15 min globally, 20 req / hour on auth-adjacent paths. 429 includes Retry-After in seconds. Webhooks bypass rate limits.

Events

Create, read, update and publish events. Publishing toggles cross-listing to the consumer storefront in the same call.

Example · create & publish

curl -X POST https://api.entryrate.co.uk/v1/events \
  -H "Authorization: Bearer er_live_••" \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: 8f0e5a2c-…" \
  -d '{
    "title":  "Mura Masa · UK tour",
    "venueId":"vn_strange_brew",
    "doors":  "2026-05-02T19:00:00Z",
    "tiers": [
      { "name":"Early bird", "price":1200, "stock":200 },
      { "name":"Standard",   "price":1800, "stock":200 }
    ]
  }'

Orders

Tickets & scans

QR rotation: when an event has rotatingQr: true, payloads encode an HMAC over (ticketId, windowStart). Validation is timing-safe.

Payouts

Payouts are read-only via API. Stripe owns the schedule — initiate any non-routine adjustment from the dashboard or contact support.

Webhooks

Subscribe to events at Settings → Webhooks. We sign every payload with HMAC-SHA256 in the EntryRate-Signature header.

// Verifying a webhook (Node)
const sig = req.headers['entryrate-signature'];
const expected = crypto
  .createHmac('sha256', process.env.WEBHOOK_SECRET)
  .update(req.rawBody)
  .digest('hex');
if (!crypto.timingSafeEqual(Buffer.from(sig), Buffer.from(expected))) {
  return res.status(400).end();
}

Embed widget

Drop a checkout into your existing site with three lines. The widget inherits your event's tier list and posts back to Stripe directly — no servers between you and the buyer.

<!-- On your site -->
<script src="https://entryrate.co.uk/widget.js" async></script>
<div data-entryrate-event="evt_mura_masa_bristol"></div>

Works in iframe, modal or inline modes. Customise via data attributes: data-mode="modal", data-theme="light", data-tier="early-bird" for direct-to-tier links.

SDKs

Official clients with typed responses, retries, and pagination helpers. All open-source.

// JavaScript
import { EntryRate } from '@entryrate/sdk';

const er = new EntryRate(process.env.ER_KEY);

const events = await er.events.list({ status: 'live' });
for (const evt of events.data) {
  console.log(evt.title, evt.lowestPrice);
}