Nordi

Public API

Programmatic access to the catalog and orders. The key is issued in the client bot; all requests go over HTTPS.

Base URL

https://nordi.site/api/v1

There is no separate api subdomain: any api.* address is not ours — never send your key there.

Authentication

Every request carries the key header:

X-Api-Key: <ваш ключ>

Keys with signing enabled additionally require a timestamp and a body signature:

X-Timestamp: <unix epoch, секунды>
X-Signature: hmac_sha256(secret, f"{ts}\n{body}").hex()
  • Clock drift from the server must not exceed 300 seconds.
  • The signed string is «timestamp, newline, request body»; for GET the body is empty.
  • Replaying the same signature is rejected — anti-replay protection.

Endpoints

GET/healthAvailability check
GET/productsProduct catalog with filters and pagination
GET/products/{id}Product by public number (sku)
GET/instantInstant-delivery items only
GET/categoriesCategories with counters
GET/balanceKey balance
POST/balance/topupTop up the key balance
POST/ordersCreate an order
GET/ordersOrders of the key
GET/orders/{id}Order by id
GET/usageKey rate-limit usage

Rate limits

Catalog and categories — 120 requests per minute per key. Exceeding returns 429; retry with a delay.

Example

curl -s "https://nordi.site/api/v1/products?limit=5" \
  -H "X-Api-Key: $KEY"

Pass the key via an environment variable, not inline in your shell history.

Getting a key

The key is issued by the shop client bot — @nordiinsta_bot. The secret is shown once and cannot be recovered.