REST API Quickstart
Mint a personal access token, call your first endpoint and receive your first signed webhook, end to end in under five minutes.
By the end of this page you'll have a working sbt_ API token, a successful GET /v1/teams/current call, and a webhook endpoint receiving subscription.created events.
Prerequisites
- A Subscriby account (any tier — Free, Starter, or Growth)
- Access to a terminal with
curlor an HTTP client of your choice
Mint an API token
Open Settings → Developer → API Tokens at https://app.subscriby.net/settings/tokens. Click Create Token.
Tick these abilities:
team:view— lets the token identify the team it is scoped toproject:view-any+project:view— read-only project accesswebhook-endpoint:manage— so the same token can also create webhook endpoints
Leave scope:team:<uuid> on "current team" (default).
Click Create. The plain-text token (sbt_live_...) is shown once — copy it now; it is not retrievable later.
Confirm the token works
curl
curl https://api.subscriby.net/v1/teams/current \
-H "Authorization: Bearer sbt_live_..."PHP (Laravel Http)
use Illuminate\Support\Facades\Http;
$response = Http::withToken('sbt_live_...')
->get('https://api.subscriby.net/v1/teams/current');
$team = $response->json('data');Node (fetch)
const response = await fetch("https://api.subscriby.net/v1/teams/current", {
headers: { Authorization: "Bearer sbt_live_..." },
});
const { data: team } = await response.json();Python (requests)
import requests
response = requests.get(
"https://api.subscriby.net/v1/teams/current",
headers={"Authorization": "Bearer sbt_live_..."},
)
team = response.json()["data"]Expected response:
{
"data": {
"id": "a83f0d51-4c92-4b7e-8615-2fd9e70a3c86",
"name": "Your Team",
"owner_user_id": "2a91c4e7-6f38-4b52-8e0d-9c1a7b3f5d80",
"personal": true,
"created_at": "2026-02-14T07:12:33+00:00"
}
}Register a webhook endpoint
Point a webhook.site URL (or any HTTPS endpoint you control) at subscription.created:
curl https://api.subscriby.net/v1/webhook-endpoints \
-X POST \
-H "Authorization: Bearer sbt_live_..." \
-H "Content-Type: application/json" \
-H "Idempotency-Key: $(uuidgen)" \
-d '{
"name": "First webhook",
"url": "https://webhook.site/<your-uuid>",
"events": ["subscription.created"]
}'Expected response (201 Created):
{
"data": {
"id": "c62a08f4-1b7d-4e35-9860-a37f5d21e0b9",
"name": "First webhook",
"events": ["subscription.created"],
"is_active": true
},
"secret": "whsec_abc123..."
}Copy the secret now. Subsequent GET /v1/webhook-endpoints calls never
include it. Use it to verify every incoming SB-Signature: t=...,v1=...
header — see signature verification.
Trigger an event
In your Subscriby dashboard, create a test access code against any plan and redeem it from an incognito bot chat. Within a few seconds the webhook.site URL should receive a POST with a subscription.created envelope.
Next steps
- Authentication deep dive — ability combinations, revocation, rotation
- Idempotency — make your retries safe
- Webhooks quickstart — signature verification, retry semantics
- Errors — every error code + remediation hint
How is this guide?
Last updated on
REST API
The versioned API at api.subscriby.net: every mutation the dashboard can make, scoped by a personal access token, for agents, Zapier, n8n and more.
Authentication
Personal access tokens, ability scopes and tenant resolution for the REST API and the MCP server, and what the API will not accept.