Your choice about storage on this device

We store a few things in your browser so the site works: your language, your colour scheme, and your session if you sign in. Beyond that, analytics is yours to allow or refuse — nothing is loaded and nothing reports your visit until you say yes. We run no advertising.

What we storePrivacy Policy

Start free

Using the API

What the API is for, how to get a key, and what a key can never do.

Last updated August 21, 2026

What it is for

Everything you do in the panel with your orders, eSIMs, prices and storefront, your own systems can do too. The usual reasons are a nightly reconciliation against your accounts, repricing hundreds of packages at once, and putting order status into whatever your support team already has open.

It is on the Scale plan. On any other plan the section below does not appear and a key would be refused, with nothing else about your account affected.

The endpoint-by-endpoint reference lives at api.esimbit.com/docs/reseller-api, and it is in English only: field names and error codes are English wherever you read them, and a translated copy that fell behind would be worse than none. There is a link to it on the API keys screen.

Getting a key

Keys live under API keys in the panel, and only the account owner can create one. A key outlives whoever made it, and revoking it is the only way to take it back — the same reason billing and handing over the account sit with the owner too.

  1. Open API keys in the panel.
  2. Give the key a name you will still understand in six months, when you are deciding whether it is still in use.
  3. Tick only the scopes that integration needs. Scopes cannot be added later; you create a new key instead.
  4. Set an expiry if you can. A key with no expiry is a key nobody ever reviews.
  5. Copy the secret. It is shown once and never again.

We store only a hash of the key, so there is no screen and no support request that can show it to you a second time. If it is lost, create another and revoke the old one.

What a key can never do

Some things stay in the panel, behind a person. This is not a gap to be filled later — it is the point.

  • Money. Refunds, checkout, the billing portal and invoices.
  • People. Invitations, role changes, removals and handing over the account.
  • Secrets. Creating or deleting a provider connection, which carries your own supplier credentials.
  • Deleting a storefront, which would take every order it ever handled with it.
  • Creating more keys. A credential that can issue credentials cannot be revoked in one action.

A key also cannot reach past the role of the person who created it, and that is re-checked on every request — so demoting somebody narrows their keys the same afternoon.

Being told, instead of asking

Buying the eSIM from your provider happens in the background, so the request that places an order cannot hand you the eSIM. Rather than polling until it appears, you register a webhook and we tell you when it is ready.

Every delivery is signed, so your system can prove it came from us and not from somebody who guessed your URL. An endpoint that keeps failing is switched off with the reason recorded, and every attempt is kept — successes included — so "did you send it?" has a real answer.