ibakepro API Documentation

The ibakepro REST API (v2) is a JSON API over a single ibakepro account. It covers the product catalog, orders, customers, expenses, hosted checkout sessions, reference data, and webhook subscriptions.

What exists

Every route below is live. Nothing else is.

Area	Methods	Scope
Products	GET /products, GET /products/{id}	products:read
Product search	POST /products/search-token	products:search
Orders	GET /orders, GET /orders/{id}, POST /orders	orders:read, orders:write
Customers	GET /customers, GET /customers/{id}, POST /customers	customers:read, customers:write
Expenses	GET /expenses, GET /expenses/{id}, POST /expenses	expenses:read, expenses:write
Checkout	POST /checkout	checkout:write
Availability	GET /availability	reference:read
Reference data	GET /reference/{blocked-dates,custom-fields,event-categories,expense-categories,payment-methods,time-slots}	reference:read
Webhooks	GET, POST, PATCH, DELETE on /webhooks and /webhooks/{id}, plus /test, /rotate-secret, /events	webhooks:manage

Limits

• Products are read-only. There is no endpoint that creates, updates, or deletes a product. The catalog is authored in the ibakepro dashboard.
• GET /products returns storefront-visible products only. Products that are not active, not storefront-enabled, or deleted are never returned, so the list is not a full catalog export.
• Orders are create and read only. No endpoint updates, cancels, or deletes an order. Once POST /orders returns, the order is changed only in the dashboard.
• Customers and expenses are create and read only. Same shape as orders: POST and GET, no PATCH and no DELETE.
• Payments have no endpoints. You cannot record, refund, or list a payment over the API. Payment state is observable through the payment.created, payment.updated, payment.completed, payment.failed, and payment.refunded webhook events.
• Pantry stock and components are not exposed. No endpoint reads or writes stock levels, ingredients, or recipe components.
• POST /checkout does not create an order and does not take payment. It reprices a cart server-side, stores a checkout session, and returns a hosted checkout URL.
• pricing:read is granted to publishable keys but has no endpoint behind it. It is inert until a quote endpoint ships.

Two key types

A secret key (ibp_sk_) may hold any scope the account grants and is accepted by every endpoint. A publishable key (ibp_pk_) is restricted at creation time to products:read, products:search, reference:read, pricing:read, and checkout:write; the endpoints that accept one return CORS headers and answer OPTIONS preflights, and every other endpoint rejects it with 403 publishable_key_not_allowed.

Getting started

Create an API key in the ibakepro dashboard under Settings > Integrations > Developers, then send it as a Bearer token. Keys are regional: the region segment in the key (ibp_sk_live_au_...) must match the host subdomain you call (au.api.ibakepro.com), or the request returns 401 invalid_api_key. The REST API requires the Business plan; on any other plan every request returns 403 plan_required.