From your first request
to a working integration.
Start with product listing. Set up authentication and manage your SSL processes from your own server.
Authentication
Base URL: https://api.sslcipher.com/api/v1
- Create a key from the API Keys section in the reseller panel.
- Add your integration server’s outbound IP address to the key’s allowlist.
- Send the
X-Api-KeyandX-Api-Secretheaders together with every request. - Add the
Accept: application/jsonheader for JSON responses.
Keep your secret key only in server environment variables or a secure secrets store. Never add it to browser code, public repositories or log files.
List products
This read-only request returns the products available to your account. Without your key and IP allowlisting, you won’t get an authorized response.
curl 'https://api.sslcipher.com/api/v1/products' \
-H "Accept: application/json" \
-H "X-Api-Key: $SSLCIPHER_API_KEY" \
-H "X-Api-Secret: $SSLCIPHER_API_SECRET"<?php
$ch = curl_init('https://api.sslcipher.com/api/v1/products');
curl_setopt_array($ch, [
CURLOPT_RETURNTRANSFER => true,
CURLOPT_HTTPHEADER => [
'Accept: application/json',
'X-Api-Key: ' . getenv('SSLCIPHER_API_KEY'),
'X-Api-Secret: ' . getenv('SSLCIPHER_API_SECRET'),
],
]);
$response = curl_exec($ch);
if ($response === false) {
throw new RuntimeException(curl_error($ch));
}
$status = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);
if ($status !== 200) {
throw new RuntimeException('API HTTP ' . $status);
}
$products = json_decode($response, true, 512, JSON_THROW_ON_ERROR);// Sunucu tarafında çalıştırın.
const response = await fetch(
'https://api.sslcipher.com/api/v1/products',
{ headers: {
'Accept': 'application/json',
'X-Api-Key': process.env.SSLCIPHER_API_KEY,
'X-Api-Secret': process.env.SSLCIPHER_API_SECRET,
} }
);
if (!response.ok) throw new Error('API HTTP ' + response.status);
const products = await response.json();Response structure
The product list response contains an data array. Each product includes id, name, brand, type, is_wildcard, is_multi_domain, max_san fields and an price field calculated for your account. Check the current product details before creating an order.
Core endpoints
| Method | Path | Action |
|---|---|---|
| GET | /products | List products |
| GET | /products/{id} | Product and pricing options |
| GET | /orders | List orders |
| POST | /orders | Create order |
| GET | /orders/{id} | Get order details |
| GET | /orders/{id}/status | Get order status |
| POST | /orders/{id}/verify | Check validation |
| POST | /orders/{id}/dcv | Change validation method |
| POST | /orders/{id}/reissue | Request reissue |
| GET | /orders/{id}/download/zip | Download certificate archive |
Paths are relative to the base URL. The fields required for write operations depend on the product and the operation’s status. Confirm the field schemas for order integration with our support team; this page is a getting-started guide.
Handle errors explicitly
401 UnauthorizedCheck that the key and secret are valid.403 Access deniedConfirm the server is on the IP allowlist.422 Validation errorReview the request fields and the returned error messages.429 Rate limitReduce your request rate and apply controlled retries.Don’t blindly retry write operations like orders after a network error. Check first whether the operation went through; otherwise you risk creating duplicate operations.
Related guides
How to Install an SSL Certificate (Nginx, Apache, cPanel)
A practical, step-by-step guide to installing an SSL certificate on Nginx, Apache, and cPanel — plus HTTP-to-HTTPS redirects, HSTS, testing, and renewal automation.
SSL Certificate Validity Is Shrinking: The 200-Day, 100-Day and 47-Day Timeline
SSL certificate validity is shrinking in stages: 200 days from 2026, 100 from 2027, 47 from 2029. Here's the CA/Browser Forum timeline and how website owners, hosting providers and resellers should prepare.