Libraries tagged by session scope

Context support (request, session and application scope) for n2n framework.

Go to Download

RevKeen is a fintech-grade API for payments, subscriptions, invoices, and billing. The canonical production MCP server is available at `https://mcp.revkeen.com/mcp`. **API Version:** `2026-05-01` — Pin with the `RevKeen-Version` header. **Quick Links:** [Full Documentation](https://docs.revkeen.com) | [Authentication](https://docs.revkeen.com/authentication) | [OAuth](https://docs.revkeen.com/oauth) | [SDKs](https://docs.revkeen.com/sdks) | [Webhooks](#webhooks) | [MCP Guide](https://docs.revkeen.com/mcp) ## Authentication Two authentication methods are supported: ### API Keys (recommended for server-to-server REST API integrations) Send your API key in the `x-api-key` header. Get keys from the [Dashboard](https://app.revkeen.com/settings/api-keys). Use `rk_sandbox_*` for test mode and `rk_live_*` for production. ### OAuth 2.1 (recommended for MCP and third-party integrations) Use OAuth 2.1 with PKCE for authorization code flow or client credentials for server-to-server. Tokens are sent via `Authorization: Bearer rk_oauth_*`. See the [OAuth guide](https://docs.revkeen.com/oauth) for setup. - **Authorization Code + PKCE** — user-facing integrations, MCP hosts - **Client Credentials** — server-to-server, automated workflows - **Dynamic Client Registration** — MCP hosts that auto-register ## MCP Integration RevKeen's canonical production MCP server is `https://mcp.revkeen.com/mcp` using Streamable HTTP and OAuth 2.1 bearer tokens. - **Customer launch surface** — read-first customer v1 tools with least-privilege scopes - **Host setup guide** — see the [MCP guide](https://docs.revkeen.com/mcp) for ChatGPT, Claude, and compatible MCP hosts ## API Key Scopes Scopes follow `{resource}:{action}` format (e.g., `invoices:read`, `customers:*`). See [full scope reference](https://docs.revkeen.com/authentication#scopes). | Category | Scope | Description | |----------|-------|-------------| | **Payments & Checkout** | `checkout:read` | View checkout session details | | | `checkout:write` | Create and manage checkout sessions | | | `cart:read` | View cart session details (REV-3511) | | | `cart:write` | Create and mutate cart sessions, line items, add-ons (REV-3511) | | | `payment_links:read` | View payment links | | | `payment_links:write` | Create and manage payment links | | | `charges:read` | View one-time charges | | | `charges:write` | Create one-time charges for customers | | | `payments:read` | View payment details | | | `payments:write` | Capture or void payments | | | `payment_intents:read` | View payment intent details | | | `payment_intents:write` | Create, confirm, capture, and cancel payment intents | | | `setup_intents:read` | View setup intent details | | | `setup_intents:write` | Create, confirm, and cancel setup intents | | | `payment_methods:read` | View saved payment methods | | | `payment_methods:write` | Attach and detach payment methods | | **Billing** | `invoices:read` | View invoices | | | `invoices:write` | Create, update, and manage invoices | | | `subscriptions:read` | View subscriptions | | | `subscriptions:write` | Create, update, pause, and cancel subscriptions | | | `subscription_schedules:read` | View subscription schedule details | | | `subscription_schedules:write` | Create, update, cancel, and release subscription schedules | | | `orders:read` | View orders | | | `orders:write` | Create and manage orders | | | `credit_notes:read` | View credit notes | | | `credit_notes:write` | Create and void credit notes | | **Products & Pricing** | `products:read` | View product catalog | | | `products:write` | Create and update products | | | `prices:read` | View pricing information | | | `prices:write` | Create and update prices | | | `discounts:read` | View discount codes | | | `discounts:write` | Create and manage discount codes | | | `tax_rates:read` | View tax rate configurations | | | `tax_rates:write` | Configure tax rates | | **Usage & Metering** | `meters:read` | View meter configurations | | | `meters:write` | Create and update meters | | | `usage:read` | View usage events and balances | | | `usage:write` | Ingest usage events | | **Customers** | `customers:read` | View customer information | | | `customers:write` | Create and update customers | | | `entitlements:read` | View customer entitlements / feature access | | | `entitlements:write` | Grant and revoke customer entitlements | | | `businesses:read` | View business entities | | | `businesses:write` | Manage business entities | | **Money Movement** | `refunds:read` | View refund details | | | `refunds:write` | Issue refunds | | | `voids:read` | View voided transactions | | | `voids:write` | Void unsettled transactions | | | `disputes:read` | View chargebacks and disputes | | | `disputes:write` | Respond to disputes | | | `payouts:read` | View payout and settlement data | | **Direct Debit** | `mandates:read` | View Direct Debit mandates and collection status | | | `mandates:write` | Create, suspend, reinstate, and cancel Direct Debit mandates | | **Terminal** | `terminal:read` | View terminal devices and card-present payments | | | `terminal:write` | Initiate, cancel, refund, and void terminal payments | | **Data Exchange** | `exports:read` | View and download data exports | | | `exports:write` | Create data exports | | | `imports:read` | View import status and history | | | `imports:write` | Upload and run data imports | | **Analytics & Reporting** | `analytics:read` | View analytics and reports | | | `finance:read` | View financial reports | | **Communication** | `comms:read` | View SMS and email delivery logs | | | `comms:write` | Send SMS, email, and WhatsApp messages | | | `automations:read` | View automations, runs, approvals, and traces | | | `automations:write` | Create automations and trigger runs | | **Integrations** | `apps:read` | View connected applications | | | `apps:write` | Manage app connections | | | `webhooks:read` | View webhook endpoints | | | `webhooks:write` | Manage webhook endpoints | | | `integrations:read` | View integration status and sync logs | | | `integrations:write` | Activate, configure, and sync integrations | | | `events:read` | View webhook event logs | | | `events:write` | Resend and test webhook events | | | `sync:read` | View sync watermarks and state | | | `sync:write` | Update sync watermarks | ## Environments | Environment | Base URL | API Key Prefix | |-------------|----------|----------------| | **Staging** | `https://staging-api.revkeen.com/v2` | `rk_sandbox_*` | | **Production** | `https://api.revkeen.com/v2` | `rk_live_*` | ## Idempotency Include `Idempotency-Key` header (UUID) on mutation requests. Keys are valid for 24 hours. ## Rate Limits | Plan | Requests/min | Burst | |------|-------------|-------| | **Staging** | 100 | 200 | | **Production** | 1000 | 2000 | | **Enterprise** | Custom | Custom |

Go to Download

Public API documentation for Zippendo. Authenticate using your API token (Bearer token prefixed with zipp_). **Brands (sub-accounts).** An organization can be split into brands, each keeping its own orders, shipments and configuration separate. There are two ways to scope requests to one brand, and NEITHER changes any request body: 1. **Bind the token.** Create an API token with a `brandId` and every request it makes is confined to that brand — reads filtered, writes stamped. This is the recommended way to give a single brand's team its own credential. 2. **Send the `X-Zippendo-Brand` header.** An organization-wide token can scope an individual request by sending the brand's id or slug in this header. Most SDKs let you set it once on the client so every call inherits it. A brand-bound token that receives an `X-Zippendo-Brand` header naming a different brand is rejected with `403 BRAND_ACCESS_DENIED` — the binding is never widened. Omit both and requests cover the whole organization, which is the behaviour of every existing token. Records that belong to no brand carry `brandId: null`. Configuration (carriers, shipping rules, addresses) with a null brand is organization-wide and remains visible inside every brand; orders and shipments with a null brand are only visible organization-wide. List endpoints additionally take a `?brandScope=own|shared|both` parameter to narrow further within whichever brand context already applies. `own` returns only rows assigned to that brand, and requires a brand context — a brand-bound token, a resolved brand session, or the `X-Zippendo-Brand` header above — otherwise `400`. `shared` returns only the organization-wide rows (equivalent to filtering `brandId=none`). The default, `both`, keeps the existing behaviour: a brand context sees its own rows plus the organization-wide ones. Set `X-Zippendo-Brand-Scope` as a client default to apply the same choice to every request instead of repeating the query parameter on each call — an explicit `brandScope` query parameter always wins over the header, and a blank header value is ignored. Brands themselves are managed under the **Brands** tag. Retiring a brand is done with `POST /orgs/{orgId}/brands/{brandId}/archive` — permanent deletion is a dashboard-only action, since it is refused while any order, shipment, member or token still references the brand. Brands require a plan that includes them; creating one beyond your plan's limit returns `403`.

Go to Download

Build a fully custom headless storefront - your own web app, mobile app, or POS - against a single OE Commerce store. Every endpoint below is namespaced under `/api/v1/store/...`. Building admin/back-office tooling instead? See [/docs/admin](/docs/admin). New here? [/guides/store](/guides/store) walks through getting a key, the anonymous cart session, and calling your first endpoints step by step - this page is the field-level reference to come back to afterward. ## Getting Started 1. Click the **Authorize** button at the top of this page. 2. Provide credentials: - **X-Commerce-Key** (always required) - your store's Store Access Key from Backoffice > Settings > Application APIs. `pk_store_...` (publishable) is safe for browser/mobile code; `sk_store_...` (secret) is server-to-server only and is rejected outright if a browser Origin header is present. - **Bearer** (only for endpoints acting on a specific customer - Account, Orders, Wishlists, etc.) - the token from **Auth > register** or **Auth > login**. Once authorized, you can explore and test all available endpoints directly from this interface. ## Anonymous Carts A guest cart is tracked by an `X-Session-Ref` header, not a cookie - the server generates one on your first request and echoes it back on every response after. Keep sending back whatever value you last received. Logging in carries that same cart forward onto the customer's account automatically, with no separate merge step. ## Errors Failures use RFC 9457 Problem Details (`application/problem+json`) with a stable `code` field for programmatic handling, e.g. `store_key_invalid`, `store_key_revoked`, `store_key_scope_denied`, `rate_limited`. A rejected *business* action (e.g. adding fewer than a product's minimum order quantity to the cart) instead comes back as HTTP 200 with `"success": false` and a human-readable `message` - always check `success` in the body, not just the HTTP status code. ## Rate Limits Requests are limited per Store Access Key (200/minute). The credential-stuffing surface (register/login/forgot-password/reset-password) is limited more tightly per caller IP (10 per 5 minutes). A 429 response includes a `Retry-After` header.

Go to Download

A flexible and pluggable storage strategy for managing scoped, temporary key-value data using sessions, tokens, Redis, and more.

Go to Download

Simple session abstraction based on PSR-11 containers with scopes.

Go to Download

Sandboxed, session-scoped agent workspaces for Laravel — a scoped Storage disk behind a path guard, shipped with the adversarial corpus that proves the boundary holds.

Go to Download

# Introduction SendPost provides email API and SMTP relay which can be used not just to send & measure but also alert & optimised email sending. You can use SendPost to: * Send personalised emails to multiple recipients using email API * Track opens and clicks * Analyse statistics around open, clicks, bounce, unsubscribe and spam At and advanced level you can use it to: * Manage multiple sub-accounts which may map to your promotional or transactional sending, multiple product lines or multiple customers * Classify your emails using groups for better analysis * Analyse and fix email sending at sub-account level, IP Pool level or group level * Have automated alerts to notify disruptions regarding email sending * Manage different dedicated IP Pools so to better control your email sending * Automatically know when IP or domain is blacklisted or sender score is down * Leverage pro deliverability tools to get significantly better email deliverability & inboxing [](https://god.gw.postman.com/run-collection/33476323-e6dbd27f-c4a7-4d49-bcac-94b0611b938b?action=collection%2Ffork&source=rip_markdown&collection-url=entityId%3D33476323-e6dbd27f-c4a7-4d49-bcac-94b0611b938b%26entityType%3Dcollection%26workspaceId%3D6b1e4f65-96a9-4136-9512-6266c852517e) # Overview ## REST API SendPost API is built on REST API principles. Authenticated users can interact with any of the API endpoints to perform: * **GET**- to get a resource * **POST** - to create a resource * **PUT** - to update an existing resource * **DELETE** - to delete a resource The API endpoint for all API calls is: https://api.sendpost.io/api/v1 Some conventions that have been followed in the API design overall are following: * All resources have either /api/v1/subaccount or /api/v1/account in their API call resource path based on who is authorised for the resource. All API calls with path /api/v1/subaccount use X-SubAccount-ApiKey in their request header. Likewise all API calls with path /api/v1/account use X-Account-ApiKey in their request header. * All resource endpoints end with singular name and not plural. So we have domain instead of domains for domain resource endpoint. Likewise we have sender instead of senders for sender resource endpoint. * Body submitted for POST / PUT API calls as well as JSON response from SendPost API follow camelcase convention * All timestamps returned in response (created or submittedAt response fields) are UNIX nano epoch timestamp. All resources have either /api/v1/subaccount or /api/v1/account in their API call resource path based on who is authorised for the resource. All API calls with path /api/v1/subaccount use X-SubAccount-ApiKey in their request header. Likewise all API calls with path /api/v1/account use X-Account-ApiKey in their request header. SendPost uses conventional HTTP response codes to indicate the success or failure of an API request. * Codes in the 2xx range indicate success. * Codes in the 4xx range indicate an error owing due to unauthorize access, incorrect request parameters or body etc. * Code in the 5xx range indicate an eror with SendPost's servers ( internal service issue or maintenance ) SendPost all responses return created in UNIX nano epoch timestamp. ## Authentication SendPost uses API keys for authentication. You can register a new SendPost API key at our [developer portal](https://app.sendpost.io/register). SendPost expects the API key to be included in all API requests to the server in a header that looks like the following: `X-SubAccount-ApiKey: AHEZEP8192SEGH` This API key is used for all Sub-Account level operations such as: * Sending emails * Retrieving stats regarding open, click, bounce, unsubscribe and spam * Uploading suppressions list * Verifying sending domains and more In addition to X-SubAccount-ApiKey you also have another API Key X-Account-APIKey which is used for Account level operations such as : * Creating and managing sub-accounts * Allocating IPs for your account * Getting overall billing and usage information * Email List validation * Creating and managing alerts and more You must look at individual API reference page to look at whether X-SubAccount-ApiKey is required or X-Account-ApiKey In case an incorrect API Key header is specified or if it is missed you will get HTTP Response 401 ( Unauthorized ) response from SendPost. ## HTTP Response Headers Code | Reason | Details ---------------| -----------------------| ----------- 200 | Success | Everything went well 401 | Unauthorized | Incorrect or missing API header either X-SubAccount-ApiKey or X-Account-ApiKey 403 | Forbidden | Typically sent when resource with same name or details already exist 406 | Missing resource id | Resource id specified is either missing or doesn't exist 422 | Unprocessable entity | Request body is not in proper format 500 | Internal server error | Some error happened at SendPost while processing API request 503 | Service Unavailable | SendPost is offline for maintenance. Please try again later # API SDKs We have native SendPost SDKs in the following programming languages. You can integrate with them or create your own SDK with our API specification. In case you need any assistance with respect to API then do reachout to our team from website chat or email us at **[email protected]** * [PHP](https://github.com/sendpost/sendpost_php_sdk) * [Javascript](https://github.com/sendpost/sendpost_javascript_sdk) * [Ruby](https://github.com/sendpost/sendpost_ruby_sdk) * [Python](https://github.com/sendpost/sendpost_python_sdk) * [Golang](https://github.com/sendpost/sendpost_go_sdk) # API Reference SendX REST API can be broken down into two major sub-sections: * Sub-Account * Account Sub-Account API operations enable common email sending API use-cases like sending bulk email, adding new domains or senders for email sending programmatically, retrieving stats, adding suppressions etc. All Sub-Account API operations need to pass X-SubAccount-ApiKey header with every API call. The Account API operations allow users to manage multiple sub-accounts and manage IPs. A single parent SendPost account can have 100's of sub-accounts. You may want to create sub-accounts for different products your company is running or to segregate types of emails or for managing email sending across multiple customers of yours. # SMTP Reference Simple Mail Transfer Protocol (SMTP) is a quick and easy way to send email from one server to another. SendPost provides an SMTP service that allows you to deliver your email via our servers instead of your own client or server. This means you can count on SendPost's delivery at scale for your SMTP needs. ## Integrating SMTP 1. Get the SMTP `username` and `password` from your SendPost account. 2. Set the server host in your email client or application to `smtp.sendpost.io`. This setting is sometimes referred to as the external SMTP server or the SMTP relay. 3. Set the `username` and `password`. 4. Set the port to `587` (or as specified below). ## SMTP Ports - For an unencrypted or a TLS connection, use port `25`, `2525` or `587`. - For a SSL connection, use port `465` - Check your firewall and network to ensure they're not blocking any of our SMTP Endpoints. SendPost supports STARTTLS for establishing a TLS-encrypted connection. STARTTLS is a means of upgrading an unencrypted connection to an encrypted connection. There are versions of STARTTLS for a variety of protocols; the SMTP version is defined in [RFC 3207](https://www.ietf.org/rfc/rfc3207.txt). To set up a STARTTLS connection, the SMTP client connects to the SendPost SMTP endpoint `smtp.sendpost.io` on port 25, 587, or 2525, issues an EHLO command, and waits for the server to announce that it supports the STARTTLS SMTP extension. The client then issues the STARTTLS command, initiating TLS negotiation. When negotiation is complete, the client issues an EHLO command over the new encrypted connection, and the SMTP session proceeds normally. If you are unsure which port to use, a TLS connection on port 587 is typically recommended. ## Sending email from your application ```javascript "use strict"; const nodemailer = require("nodemailer"); async function main() { // create reusable transporter object using the default SMTP transport let transporter = nodemailer.createTransport({ host: "smtp.sendpost.io", port: 587, secure: false, // true for 465, false for other ports auth: { user: "" , // generated ethereal user pass: "", // generated ethereal password }, requireTLS: true, debug: true, logger: true, }); // send mail with defined transport object try { let info = await transporter.sendMail({ from: '[email protected]', to: '[email protected]', subject: 'Test Email Subject', html: 'Hello Geeks!!!', }); console.log("Message sent: %s", info.messageId); } catch (e) { console.log(e) } } main().catch(console.error); ``` For PHP ```php

Go to Download

Passwordless login via a unique emailed link, with an optional emailed verification code as a second factor, and per-login session scoping to specific records.

Go to Download

Single-database multi-tenancy for Laravel: fail-closed row-level isolation, domain resolution and session scoping

Go to Download