Developer SDKs — overview
Official SDKs for Python, Node.js, PHP, and Go: OAuth, list quotes, create orders, subscribe webhooks. Open-source on GitHub.
Available SDKs
Official SDKs for Python, Node.js, PHP, and Go: OAuth, list quotes, create orders, subscribe webhooks. Open-source on GitHub. All SDKs are open-source under MIT, follow semantic versioning, and ship with full TypeScript / type definitions where applicable. Each SDK abstracts OAuth 2.0 token management, retries with exponential backoff, idempotency keys for write operations, and webhook signature verification.
| Language | Min version | Install | Docs |
|---|---|---|---|
| Python | 3.9+ | pip install merch-sdk | Python SDK |
| Node.js / TypeScript | 18+ | npm install @merch/sdk | Node SDK |
| PHP | 8.1+ | composer require merch/sdk | PHP SDK |
| Go | 1.21+ | go get github.com/merch/sdk-go | Go SDK |
Common operations
Across all SDKs, the same set of resources is exposed with idiomatic patterns per language:
- OAuth 2.0 — client_credentials grant; tokens cached and refreshed automatically
- Quotes — list, get, create, accept, decline
- Orders — create, get, cancel, list shipments, track
- Catalog — list products, get product detail, list variants
- Webhooks — register, list, delete; signature verification helpers
- Reports — sustainability, OTD, defect-rate, audit-doc retrieval
API regions
SDKs default to your contracted region. Available endpoints:
eu— EU data residency (Frankfurt)me— Middle East data residency (Dubai)cis— CIS data residency (Yerevan)
Authentication
All SDKs use OAuth 2.0 client_credentials. Get your client_id and client_secret from the customer portal under Settings → API Keys. Rotate keys at least every 90 days; the SDK supports zero-downtime rotation via overlapping key pairs.
Webhooks
Webhook events: order.created, order.confirmed, order.in_production, order.shipped, order.delivered, order.canceled, quote.expiring, invoice.issued, invoice.paid. Each SDK ships a verify helper that validates HMAC signature and tolerance window (default 5 min). Re-delivery uses exponential backoff for up to 24 hours.
Rate limits
- Standard: 60 requests/minute, 5,000 requests/day
- Burst: 10 concurrent requests
- Enterprise: custom limits per MSA
- 429 Retry-After header respected automatically by all SDKs
Source code
SDKs are open-source on GitHub. Browse repositories (placeholder — public access enabled at GA in Q1 2027). Issues and PRs welcome; we triage within 2 business days.
Support
Email developers@merch.org.tr with SDK questions. Response within 1 business day for general inquiries; same-day for production-impacting issues for clients with active MSA.