Developer docs

Seller API

Connect your inventory system, receive sales, and keep orders moving.

Manage API credentials Seller dashboard

Developer docs

Seller API

Connect your inventory system, receive sales, and keep orders moving.

Manage API credentials Seller dashboard

Quick start

Production REST API over HTTPS. JSON is used except at the OAuth token endpoint.

Quick start OAuth Inventory Orders Webhooks Errors

API requests affect your live LGS Market inventory and orders. A separate sandbox is not currently offered.

1. Create credentials

Open Seller dashboard / API access, enable API access, select the minimum scopes your integration needs, and generate a client secret. The secret is shown only when created or rotated.

2. Mint an access token

curl -X POST https://lgsmarket.com/oauth/token \
  -u "$LGS_CLIENT_ID:$LGS_CLIENT_SECRET" \
  -H 'Content-Type: application/x-www-form-urlencoded' \
  --data-urlencode 'grant_type=client_credentials' \
  --data-urlencode 'scope=inventory:read inventory:write orders:read orders:manage webhooks:manage'

3. Call the API

curl 'https://lgsmarket.com/api/seller/external/inventory/listings?limit=100' \
  -H "Authorization: Bearer $LGS_ACCESS_TOKEN"

OAuth client credentials

Server-to-server authentication using a short-lived bearer token.

POST

/oauth/token

Client credentials

Use HTTP Basic authentication. Credentials may also be sent as client_id and client_secret form fields. Never place a client secret in browser code, mobile apps, URLs, logs, or source control.

{
  "access_token": "eyJhbGciOi...",
  "token_type": "Bearer",
  "expires_in": 3600,
  "scope": "inventory:read inventory:write orders:read orders:manage webhooks:manage"
}

Cache the token until shortly before expiry. Requested scopes must be a subset of the scopes assigned to the client. Disable the API client to reject its tokens immediately; rotating the client secret prevents new tokens but already-issued tokens can remain active until expiry.

Scope	Access
`inventory:read`	List seller inventory.
`inventory:write`	Create, update, delete, and bulk-sync listings.
`orders:read`	Read the authenticated seller's orders.
`orders:manage`	Update fulfillment status and tracking.
`webhooks:manage`	Register and manage event destinations.

Inventory

Use an LGS Market SKU ID or a complete TCGplayer variant tuple.

POST

/api/seller/external/inventory/listings

inventory:write

Create is an upsert. The catalog is authoritative for product, condition, language, and printing metadata.

curl -X POST https://lgsmarket.com/api/seller/external/inventory/listings \
  -H "Authorization: Bearer $LGS_ACCESS_TOKEN" \
  -H 'Content-Type: application/json' \
  -d '{"skuId":987654,"quantity":4,"price":24.99}'

Using a TCGplayer product ID

{
  "tcgplayerId": 706176,
  "condition": "Near Mint",
  "language": "English",
  "printing": "Normal",
  "quantity": 4,
  "price": 24.99
}

All four variant fields are required with tcgplayerId. Condition and language names or abbreviations are accepted. A conflicting SKU and variant tuple returns 409.

PATCH

/api/seller/external/inventory/listings

inventory:write

{"skuId":987654,"quantity":7,"price":22.50}

DELETE

/api/seller/external/inventory/listings

inventory:write

Send JSON containing either skuId or the complete TCGplayer variant tuple. Only the authenticated seller's listing is removed.

GET

/api/seller/external/inventory/listings

inventory:read

Filter with skuId, productId, or tcgplayerId plus its variant fields. limit is capped at 500.

POST

/api/seller/external/inventory/bulk

inventory:write

Submit up to 500 create, update, or delete operations, then poll /api/seller/external/inventory/bulk/<jobId> for per-operation results.

Orders

Read sales and update seller-owned fulfillment records.

GET

/api/seller/external/orders

orders:read

PATCH

/api/seller/external/orders/{orderId}/status

orders:manage

{"status":"dispatched"}

PATCH

/api/seller/external/orders/{orderId}/fulfillment

orders:manage

{
  "status": "dispatched",
  "trackingImb": "9400100000000000000000",
  "trackingCarrier": "USPS"
}

Seller fulfillment statuses are processing, dispatched, delivered, and cancelled. An API client can access only orders belonging to its seller.

Sales webhooks

Receive signed, retryable events instead of polling for every change.

The webhook service is live and uses a durable delivery queue. Event IDs are stable, so consumers can process retries idempotently.

POST

/api/seller/external/webhooks

webhooks:manage

curl -X POST https://lgsmarket.com/api/seller/external/webhooks \
  -H "Authorization: Bearer $LGS_ACCESS_TOKEN" \
  -H 'Content-Type: application/json' \
  -d '{
    "url":"https://seller.example.com/webhooks/lgsmarket",
    "events":["sale.created","order.fulfilled","order.cancelled"],
    "description":"Primary OMS"
  }'

The response contains endpoint and secret. Store the signing secret immediately; it is returned only when the endpoint is created or its secret is rotated. Destinations must be publicly resolvable HTTPS URLs and cannot resolve to private, loopback, link-local, or reserved addresses.

GET

/api/seller/external/webhooks

webhooks:manage

PATCH

/api/seller/external/webhooks/{webhookId}

webhooks:manage

DELETE

/api/seller/external/webhooks/{webhookId}

webhooks:manage

PATCH accepts url, events, description, status (enabled or disabled), and rotateSecret: true.

Event	When sent
`sale.created`	A seller-specific order reaches paid status.
`order.fulfilled`	The seller marks the order delivered.
`order.cancelled`	The seller fulfillment is cancelled.

Verify every request

Compute HMAC-SHA256 over X-LGS-Timestamp + "." + rawRequestBody. Compare the hexadecimal digest to the value after v1= in X-LGS-Signature using a timing-safe comparison. Also reject stale timestamps and de-duplicate X-LGS-Event-Id.

import crypto from 'node:crypto';

const signed = req.headers['x-lgs-timestamp'] + '.' + rawBody;
const expected = 'v1=' + crypto
  .createHmac('sha256', process.env.LGS_WEBHOOK_SECRET)
  .update(signed)
  .digest('hex');

const valid = expected.length === signature.length &&
  crypto.timingSafeEqual(Buffer.from(expected), Buffer.from(signature));

Delivery and retries

Return any 2xx response within 10 seconds. Failed attempts retry after 1 minute, 5 minutes, 30 minutes, 2 hours, 8 hours, and 24 hours. After the seventh failed attempt the delivery is marked failed. Redirects are not followed. Delivery order is not guaranteed.

{
  "id": "sale.created:seller_123:order_456",
  "type": "sale.created",
  "createdAt": "2026-07-31T12:00:00.000Z",
  "data": {
    "orderId": "order_456",
    "sellerId": "seller_123",
    "status": "paid",
    "currency": "USD",
    "items": []
  }
}

Errors and support

Use status codes to decide whether a request is safe to retry.

Status	Meaning	Action
`400`	Malformed or invalid request.	Correct it before retrying.
`401`	Credentials or bearer token rejected.	Mint a token or check the client.
`403`	Required scope is missing.	Update client scopes.
`404`	Catalog, listing, order, or webhook not found.	Reconcile the identifier.
`409`	Catalog mismatch or duplicate endpoint.	Resolve the conflict.
`500 / 502 / 503`	Temporary platform or dependency failure.	Retry with bounded exponential backoff.

Do not retry unchanged validation failures. For integration help, open a support request with the endpoint, timestamp, response status, and request ID. Never include client or webhook secrets.

curl -X POST https://lgsmarket.com/oauth/token \ -u "$LGS_CLIENT_ID:$LGS_CLIENT_SECRET" \ -H 'Content-Type: application/x-www-form-urlencoded' \ --data-urlencode 'grant_type=client_credentials' \ --data-urlencode 'scope=inventory:read inventory:write orders:read orders:manage webhooks:manage'

Scope

Access

inventory:read

List seller inventory.

inventory:write

Create, update, delete, and bulk-sync listings.

orders:read

Read the authenticated seller's orders.

orders:manage

Update fulfillment status and tracking.

webhooks:manage

curl -X POST https://lgsmarket.com/api/seller/external/inventory/listings \ -H "Authorization: Bearer $LGS_ACCESS_TOKEN" \ -H 'Content-Type: application/json' \ -d '{"skuId":987654,"quantity":4,"price":24.99}'

curl -X POST https://lgsmarket.com/api/seller/external/webhooks \ -H "Authorization: Bearer $LGS_ACCESS_TOKEN" \ -H 'Content-Type: application/json' \ -d '{ "url":"https://seller.example.com/webhooks/lgsmarket", "events":["sale.created","order.fulfilled","order.cancelled"], "description":"Primary OMS" }'

Event

When sent

sale.created

A seller-specific order reaches paid status.

order.fulfilled

The seller marks the order delivered.

order.cancelled

The seller fulfillment is cancelled.

import crypto from 'node:crypto'; const signed = req.headers['x-lgs-timestamp'] + '.' + rawBody; const expected = 'v1=' + crypto .createHmac('sha256', process.env.LGS_WEBHOOK_SECRET) .update(signed) .digest('hex'); const valid = expected.length === signature.length && crypto.timingSafeEqual(Buffer.from(expected), Buffer.from(signature));

{ "id": "sale.created:seller_123:order_456", "type": "sale.created", "createdAt": "2026-07-31T12:00:00.000Z", "data": { "orderId": "order_456", "sellerId": "seller_123", "status": "paid", "currency": "USD", "items": [] } }

Status

Meaning

Action

400

Malformed or invalid request.

Correct it before retrying.

401

Credentials or bearer token rejected.

Mint a token or check the client.

403

Required scope is missing.

Update client scopes.

404

Catalog, listing, order, or webhook not found.

Reconcile the identifier.

409

Catalog mismatch or duplicate endpoint.

Resolve the conflict.

500 / 502 / 503

Temporary platform or dependency failure.

Retry with bounded exponential backoff.