Sign in

Pixta for developers

Plug your events into Pixta.

The Partner API connects your system to Pixta’s events, ticket lots, orders, buyers and reports — and sends a signed webhook when an order is paid, canceled or refunded.

Request an API keyBrowse the reference
Download OpenAPI

Base URLs

Production
https://api.pixta.me/partner/v1
Staging
https://api.pixta.dev/partner/v1
curl https://api.pixta.me/partner/v1/events \
  -H "Authorization: Bearer $PIXTA_API_KEY"

Start in three steps

  1. 01

    Get your key

    The Pixta team issues one key per integration, scoped to its producers.

  2. 02

    Authenticate

    Send the key on every request, in the Authorization header.

  3. 03

    List and subscribe

    Read your events and register a webhook to receive orders in real time.

What you can build

  • Events and lots

    Create and edit events, cover images, ticket lots and coupons for your producers.

  • Orders and tickets

    List orders and tickets, check entrance at the door and cancel with a refund.

  • Buyers

    Search buyers and each buyer’s purchase history, per producer.

  • Reports

    Sales, revenue and conversion for every event, ready for your dashboard.

  • Webhooks

    order.paid, order.canceled and order.refunded, signed with HMAC-SHA256.

  • start.gg

    Tournament orders carry the player’s start.gg identity to build the brackets.

Verify webhook signatures

Every delivery carries X-Pixta-Signature: sha256=<hex>, the HMAC-SHA256 of the raw body with your endpoint’s secret. Compare in constant time before processing, and answer 2xx within 10 seconds; failed deliveries are retried with backoff.

Headers on every delivery

X-Pixta-Event
the event (order.paid, order.canceled, order.refunded)
X-Pixta-Delivery-Id
the delivery id, to ignore repeats
X-Pixta-Signature
the HMAC-SHA256 signature of the body

Node.js

import crypto from "node:crypto";

export function isFromPixta(rawBody, signature, secret) {
  const expected = "sha256=" +
    crypto.createHmac("sha256", secret).update(rawBody).digest("hex");
  const a = Buffer.from(expected);
  const b = Buffer.from(signature ?? "");
  return a.length === b.length && crypto.timingSafeEqual(a, b);
}

Python

import hashlib, hmac

def is_from_pixta(raw_body: bytes, signature: str, secret: str) -> bool:
    expected = "sha256=" + hmac.new(
        secret.encode(), raw_body, hashlib.sha256
    ).hexdigest()
    return hmac.compare_digest(expected, signature or "")

Ruby

def from_pixta?(raw_body, signature, secret)
  expected = "sha256=#{OpenSSL::HMAC.hexdigest("SHA256", secret, raw_body)}"
  ActiveSupport::SecurityUtils.secure_compare(expected, signature.to_s)
end

Tournaments with start.gg

When the event’s checkout form asks for the start.gg login, orders and webhooks carry order.startgg with the player’s user ID, player ID, gamer tag, slug, prefix, name, email and avatar. Producers can limit that field to some tickets — players only, for example — and then only those orders carry it.

"startgg": {
  "user_id": "999",
  "player_id": "42",
  "gamertag": "Ace",
  "slug": "873d03cc",
  "prefix": "TEAM",
  "name": "Ana Silva",
  "email": "ace@example.com",
  "avatar_url": "https://images.start.gg/…"
}

API reference

Every endpoint, parameter, response and example, generated from the OpenAPI contract.

Open the full reference

Let’s integrate

Keys, the staging environment and technical questions: talk to the integrations team.

contato@pixta.me