Dashboard Overview
+5%
$0
Available Credit
+0%
Active
API Key Status
Credit Status
Available Credit
$0
$0
Limit
$0
Used
Active
Status
Credit Management
Credit Overview
Available Credit
$0
$0
Limit
$0
Used
Active
Status
Credit Utilization
0% used
$0 available
Transaction History
| Reference No | Type | Amount | Balance Before | Balance After | Date |
|---|---|---|---|---|---|
| Loading... | |||||
API Key Management
Your API Key
Use this API key to access the API programmatically. The key is only shown once when generated.
••••••••••••••••••••••••••••••••
Not available
Not available
Warning: Regenerating your API key will invalidate the current key immediately. Make sure to update your applications with the new key.
Create App (B-End API)
Create an App to access B-end APIs. You will receive App ID, Secret Key and Sign Key. Save these keys immediately - they will only be shown once!
Success! Your App has been created. Save these credentials immediately - they will not be shown again!
Profile
Merchant Information
Loading...
Bank Account
Loading...
Security
Change Password
Temu Products
Loading products...
Page 1
B-End API Documentation
Communication Protocol
All B-End API requests use AES-256-GCM encryption for request/response body and HMAC-SHA256 for request signing.
Request Flow
- Build request body (JSON)
- Encrypt body with AES-256-GCM using Secret Key
- Generate HMAC-SHA256 signature
- Send with headers: App-ID, Timestamp, Sign
Response Flow
- Receive encrypted response
- Verify response signature
- Decrypt body with AES-256-GCM
- Parse JSON response
Base URL
https://hishopping.xyz/api/v1/b
Required Headers
App-ID: {your_app_id}
Timestamp: {unix_timestamp}
Sign: {hmac_signature}
Content-Type: application/json
Encryption & Signing Details
AES-256-GCM Encryption
encrypted = AES-256-GCM(body, secret_key)
- Algorithm: AES-256-GCM
- Key: Your Secret Key (32 bytes)
- IV: Random 12 bytes (included in output)
- Output: Base64(iv + ciphertext + tag)
HMAC-SHA256 Signing
sign = HMAC-SHA256(app_id + timestamp, sign_key)
- Algorithm: HMAC-SHA256
- Key: Your Sign Key
- Data: app_id concatenated with timestamp
- Output: Hex encoded string
Your Credentials
-
-
-
Important: Sign Key and Secret Key were only shown when your App was created.
If you lost them, you can regenerate Sign Key in API Key page (Secret Key cannot be recovered).
Example: Get Product List
Complete implementation showing data structure, AES encryption, HMAC signing, and request assembly.
Signing Process
- Build business params → JSON string
- AES-GCM encrypt params (key=Secret Key) →
data - Build sign data:
{app_id, nonce, timestamp, data} - Sort keys by ASCII → JSON serialize → sign string
- HMAC-SHA256 sign (key=Sign Key) →
sign - Send request with
app_id, nonce, timestamp, data, sign
# Select a language above to see the complete code example
API Endpoints
| Method | Endpoint | Request Body | Description |
|---|---|---|---|
| GET | /products |
- | List products with pagination |
| GET | /products/:id |
- | Get product detail by ID |
| GET | /products/sku/:sku |
- | Get product by SKU |
| POST | /orders |
CreateOrderRequest | Create a new order |
| POST | /batch-orders |
CreateBatchOrderRequest | Create batch orders |
| GET | /orders/:order_no |
- | Get order detail |
| GET | /orders/merchant/:merchant_order |
- | Get order by merchant order number |
| GET | /batch-orders/:batch_no |
- | Get batch order detail |
| GET | /credit |
- | Get credit info |
| GET | /credit/transactions |
- | List credit transactions |
Data Structures
CreateOrderRequest
{
"goods_id": "string", // Required: Product ID
"sku_id": "string", // Required: SKU ID
"quantity": 1, // Required: Quantity to order
"merchant_order_no": "string", // Optional: Your order reference
"shipping_address": { // Required: Shipping address
"name": "string",
"phone": "string",
"address": "string",
"city": "string",
"country": "string",
"postal_code": "string"
}
}
Standard Response
{
"code": 0, // 0 = success, others = error
"message": "success", // Error message if code != 0
"data": { ... } // Response data (varies by endpoint)
}
Response Codes
| Code | Description |
|---|---|
0 | Success |
1001 | Invalid signature |
1002 | App not found |
1003 | App disabled |
1004 | Missing auth header |
1005 | Invalid timestamp |
1006 | Decryption failed |
2001 | Insufficient credit |
2002 | Duplicate order |
3001 | Product not found |
3002 | Product out of stock |
4001 | Invalid parameters |
5001 | Internal server error |