Build on Gish.

REST + GraphQL APIs for wishes, group buys, outcome funds, contributions, and webhooks. OAuth 2.0 for third-party apps, API keys for first-party. Stable, versioned, and production-ready.

Authentication

Two methods. API keys for backend services and first-party tools. OAuth 2.0 for third-party apps acting on a user's behalf.

# API key · header
Authorization: Bearer gsk_live_a1b2c3d4...

# OAuth flow · authorize
GET https://gishme.com/oauth/authorize?
  client_id=YOUR_ID&
  redirect_uri=https://yourapp.com/cb&
  scope="wishes:read contributions:write"&
  state="random_csrf_token"

Scopes: wishes:read, wishes:write, contributions:read, contributions:write, profile:read, profile:write, webhooks:manage.

Your first call

Get the authenticated user's public profile:

curl https://api.gishme.com/v2/me \
  -H "Authorization: Bearer gsk_live_..."

# Response 200 OK
{
  "id": "usr_8a1f3b",
  "handle": "@alexgrant",
  "name": "Alex Grant",
  "verified": true,
  "plan": "plus",
  "created_at": "2024-03-12T14:22:00Z"
}

Wishes resource

Group buys

Outcome funds

Webhooks

Events POSTed to your registered URL. Body is JSON, signed with HMAC-SHA256 in X-Gish-Signature header.

Events: wish.created, wish.updated, group.opened, group.contribution_authorized, group.goal_met, group.charged, group.refunded, outcome.payee_verified, outcome.wired, contribution.created, profile.followed.

# Verify signature
const sig = req.headers['x-gish-signature'];
const expected = crypto
  .createHmac('sha256', WEBHOOK_SECRET)
  .update(req.rawBody)
  .digest('hex');
if (sig !== expected) throw new Error('Invalid signature');

Rate limits

Rate-limit headers: X-RateLimit-Limit, X-RateLimit-Remaining, X-RateLimit-Reset. 429 responses include a Retry-After header.

Official SDKs

Errors

Standard HTTP status codes. JSON error body:

{
  "error": {
    "code": "payee_unverified",
    "message": "Outcome fund payee must be verified before campaign launch",
    "docs": "https://gishme.com/api-docs.html#outcomes",
    "request_id": "req_8a1f3b9c"
  }
}

Common codes: auth_required, auth_invalid, scope_missing, resource_not_found, validation_error, rate_limited, payee_unverified, goal_already_met.