Quickstart

1 · Create your sandbox

Sign in to the developer console and bootstrap — this creates your developer organisation, first project, sandbox environment, and a reveal-once bm_test_ API key.

2 · Store your key

The key is hash-at-rest and revealed once. Store it in your secret manager — never in source control or client-side code.

3 · Make your first call

curl https://app.bondmako.com/api/v1/invoices \
  -H "Authorization: Bearer bm_test_…" \
  -H "Idempotency-Key: inv-20261105-001" \
  -H "Content-Type: application/json" \
  -d '{
    "customerName": "Hotel Nordlicht GmbH",
    "customerEmail": "ap@hotel-nordlicht.de",
    "lineItems": [
      { "description": "Platform subscription", "quantity": 1, "unitPriceCents": 4900, "currency": "EUR" }
    ]
  }'

Mutations require an Idempotency-Key — a retry with the same key returns the stored response, never a duplicate resource.

4 · Register webhooks

Add an HTTPS endpoint in the console and subscribe to engine events (invoice.paid, sign.completed, …). Every delivery is signed — the signing secret is revealed once on registration.

5 · Go live

When sandbox proofs are green, request production access on the project. Platform review activates the production environment — then mint bm_live_ keys.