REST API, built for resellers.

Base URL

https://orphilia.com

Auth

X-API-Key: your_api_key

Send your key on every request as a header.

Rate limit

60 stock / 20 service requests per minute per key

Need more? Contact support.

Use an issued reseller credential, active and scoped to your assigned group. Store it in your server environment as ORPHILIA_RESELLER_API_KEY. The examples below run on your server; credentials, customer keys and Spotify sessions must stay out of browser code, URLs, analytics and logs. Account cookies and partner tokens do not authorize this API.

A shared 120-request IP limit also applies. On429, respect Retry-After. Stock reads save a snapshot by default; set save_to_db=false to avoid recording one.

Key features

• Secure API-key authentication.
• RESTful design, JSON responses.
• Real-time stock availability.
• Comprehensive key status tracking.
• Automatic upgrade processing.
• Renewal flow integrated.
• Multi-country support.
• Detailed error messages.

Choose how your keys look, from Orphilia branding to a format of your own.

Branded

ORPH-XXXX-XXXX-… or ORPHILIA-XXXX-…

Recognizable Orphilia prefixes that identify the key as ours.

Orphilia identity

Whitelabel

XXXX-XXXX-XXXX-… or YOURBRAND-XXXX-…

Custom formats and optional prefixes for a seamless experience under your own brand.

Your branding, your customer experience

Custom prefix & length

Have a format in mind? Email us your preferred prefix and the number of key segments you’d like.

The key lookup path is /api/v3/re/keyInfo, with orphkey in the JSON body. Upgrade requires a two-letter available country; ANY is unsupported. Responses below illustrate the direct API envelope, with safe reseller metadata.

{
  "success": true,
  "timestamp": "2026-10-20T00:00:00.000Z",
  "data": [
    {
      "country": "United States",
      "country_code": "US",
      "slots": 150
    },
    {
      "country": "United Kingdom",
      "country_code": "GB",
      "slots": 89
    }
  ],
  "reseller": {
    "authenticated": true,
    "apiKeyType": "reseller",
    "apiKey": "Issued reseller credential"
  }
}

{
  "orphkey": "your-orphkey-here"
}

{
  "id": "00000000-0000-4000-8000-000000000001",
  "orphkey": "ORPH-XXXX-XXXX-XXXX",
  "status": "success",
  "message": "Key information retrieved.",
  "used": true,
  "username": "customer",
  "purchase_date": "2025-01-01",
  "used_date": "2025-01-13",
  "verify_address": null,
  "response_time_ms": 100,
  "created_at": "2026-10-20T00:00:00.000Z",
  "reseller": {
    "authenticated": true,
    "apiKeyType": "reseller",
    "apiKey": "Issued reseller credential"
  }
}

{
  "orphkey": "your-orphkey-here",
  "login": "spotify-email",
  "password": "spotify-password",
  "country": "US"
}

{
  "orphkey": "your-orphkey-here",
  "sp_dc": "your-spotify-session-cookie-value",
  "country": "US"
}

{
  "status": "success",
  "message": "Account upgraded successfully",
  "reseller": {
    "authenticated": true,
    "apiKeyType": "reseller",
    "apiKey": "Issued reseller credential"
  }
}

{
  "orphkey": "your-orphkey-here",
  "login": "spotify-email",
  "password": "spotify-password",
  "country": "US"
}

{
  "orphkey": "your-orphkey-here",
  "sp_dc": "your-spotify-session-cookie-value",
  "country": "US"
}

{
  "status": "success",
  "message": "Account renewed successfully",
  "reseller": {
    "authenticated": true,
    "apiKeyType": "reseller",
    "apiKey": "Issued reseller credential"
  }
}

Session placeholders must be replaced privately with the customer's full50–300 character session; sp_doc is also accepted. Optional renewal email changes accept newemail or newEmail, and require a password even in session mode.

HTTP200 alone does not confirm completion. Check status; queued, pending, unknown, interrupted and timed-out requests have uncertain outcomes. Reconcile keyInfo or ask support before submitting again. Do not automatically retry upgrade or renewal.

Email/password examples are shown below. For the recommended Cookie method, replace login and password with sp_dc, using the JSON requests above. Send credentials only in the HTTPS request body; never put a cookie or password in a URL or public log.

All four examples use your own server and the destination domain. Install the named client library if needed. Examples use placeholders; use bounded timeouts for network requests and handle errors without replaying uncertain mutations.

// Server-side JavaScript only. Never embed credentials in browser code.
// Get stock availability
fetch('https://orphilia.com/api/v3/re/stocks', {
  headers: { 'X-API-Key': process.env.ORPHILIA_RESELLER_API_KEY }
})
  .then(r => r.json())
  .then(console.log);

// Upgrade an account
fetch('https://orphilia.com/api/v3/re/upgrade', {
  method: 'POST',
  headers: {
    'X-API-Key': process.env.ORPHILIA_RESELLER_API_KEY,
    'Content-Type': 'application/json'
  },
  body: JSON.stringify({
    orphkey: 'your-key-here',
    login: 'username',
    password: 'password',
    country: 'US'
  })
})
  .then(r => r.json())
  .then(console.log);

import os
import requests

headers = { 'X-API-Key': os.environ['ORPHILIA_RESELLER_API_KEY'] }

# Stock availability
r = requests.get(
    'https://orphilia.com/api/v3/re/stocks',
    headers=headers
)
print(r.json())

# Upgrade
r = requests.post(
    'https://orphilia.com/api/v3/re/upgrade',
    headers={ **headers, 'Content-Type': 'application/json' },
    json={
        'orphkey': 'your-key-here',
        'login': 'username',
        'password': 'password',
        'country': 'US'
    }
)
print(r.json())

<?php
// Stock availability
$ch = curl_init('https://orphilia.com/api/v3/re/stocks');
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_HTTPHEADER, [ 'X-API-Key: ' . getenv('ORPHILIA_RESELLER_API_KEY') ]);
$stocks = json_decode(curl_exec($ch), true);
curl_close($ch);

// Upgrade
$ch = curl_init('https://orphilia.com/api/v3/re/upgrade');
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, json_encode([
    'orphkey' => 'your-key-here',
    'login' => 'username',
    'password' => 'password',
    'country' => 'US'
]));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_HTTPHEADER, [
    'X-API-Key: ' . getenv('ORPHILIA_RESELLER_API_KEY'),
    'Content-Type: application/json'
]);
$response = json_decode(curl_exec($ch), true);
curl_close($ch);
?>

// Node.js CommonJS (.cjs), on your server.
const axios = require('axios');

// Stock availability
axios.get(
  'https://orphilia.com/api/v3/re/stocks',
  { headers: { 'X-API-Key': process.env.ORPHILIA_RESELLER_API_KEY } }
).then(r => console.log(r.data));

// Upgrade
axios.post(
  'https://orphilia.com/api/v3/re/upgrade',
  {
    orphkey: 'your-key-here',
    login: 'username',
    password: 'password',
    country: 'US'
  },
  {
    headers: {
      'X-API-Key': process.env.ORPHILIA_RESELLER_API_KEY,
      'Content-Type': 'application/json'
    }
  }
).then(r => console.log(r.data));

API integration help, troubleshooting, custom endpoints, rate-limit bumps.

Building on the API? Other devs hang out in #api-and-developers on Slack or #api-and-developers on Discord. Direct line to Orphilia engineering.