Skip to main content
M
MoonTech
Tools

API Access

Club API documentation and integration

8
Sections
1
Panels
Club Panel
Service Overview

API access lets authorized club technical staff integrate external systems — CRM, ERP, custom apps — with club data and operations through documented REST endpoints. Club Panel includes an API documentation page with authentication guidance; platform admins control which capabilities exist globally.

This guide is written for club operators and integration owners — not as a raw endpoint reference. Use menu paths and capability descriptions; implement details live in the in-panel docs viewer.

**Full technical reference** (endpoints and code samples) is also public on this website — no login: [API Documentation](/en/developers/api)
1
Section 1 of 8

Core concepts

ConceptMeaning
**API key / token**Credential identifying your integration client.
**Club scope**Keys usually limited to one club's data.
**Rate limit**Maximum requests per minute — abuse protection.
**Webhook**Server-to-server callback on events (orders, wallet tx).
**Sandbox**Test club/environment before production keys.
**Rotation**Periodic key replacement for security hygiene.
Previous sectionNext section
2
Club PanelSection 2 of 8

API documentation page

**Menu:** Club Panel → Tools & Development → API documentation

In-panel reference — authentication, available modules, example flows.

Prerequisites

  1. API access option on club subscription (or enterprise package).
  2. Technical owner assigned — not shared with all staff.
  3. IP allowlist configured if your security policy requires it (platform setting).

Page layout

  • Introduction and terms of use acceptance checkbox.
  • Authentication section — how to obtain and send tokens.
  • Capabilities grouped by domain: customers, orders, wallet, notifications.
  • Try-it console may be disabled in production — use your own HTTP client.

Step-by-step — first integration

  1. Open Tools & Development → API documentation.
  2. Read Terms — share with your legal/compliance team.
  3. Request production credentials from platform admin if not self-serve.
  4. Store client ID and secret in vault — never in frontend JavaScript.
  5. Implement authentication handshake per doc page.
  6. Test read-only call (e.g. customer lookup) on staging club.
  7. Expand to write operations after idempotency review.
  8. Schedule key rotation quarterly.
Previous sectionNext section
3
Section 3 of 8

Authentication

Typical pattern (exact fields in panel docs):

StepAction
1Exchange client credentials for short-lived **access token**
2Send token in `Authorization` header on each request
3Refresh before expiry using refresh token if issued
4On 401, re-auth — do not infinite retry with bad secret

Security rules

  • Never embed secrets in mobile apps distributed to public.
  • Use server-side proxy for member-facing features.
  • Revoke key immediately if leaked in git or ticket attachment.
  • Separate keys for staging and production.
Previous sectionNext section
4
Section 4 of 8

What can API do?

Capability list varies by subscription — common groups:

DomainExample operations (business terms)
**Customers**Lookup member, register member, update level
**Orders**List shop orders, update fulfillment status
**Wallet**Query balance, post controlled credit (if enabled)
**Acceptors**Sync acceptor directory to external CRM
**Notifications**Trigger templated push to segment
**Events**Export ticket sales register

Step-by-step — scoping project

  1. List business workflows needing automation.
  2. Map each to capability group in doc page.
  3. Mark read-only vs write — minimize write scope.
  4. Get platform confirmation for wallet write — often restricted.
Previous sectionNext section
5
Section 5 of 8

Practical scenarios

Scenario A — CRM sync nightly

  1. CRM server calls customer list export capability.
  2. Delta since last_sync timestamp.
  3. Map by mobile as unique key within club.
  4. Log errors; alert if rate limit hit — backoff exponentially.

Scenario B — ERP order fulfillment

  1. Merchant marks shipped in Merchant Panel or ERP calls order update capability.
  2. Member receives notification automatically.
  3. Reconcile settlement report separately in finance module.

Scenario C — Kiosk registration

  1. On-site kiosk backend calls register member with introducer code.
  2. OTP handled by separate SMS provider or member completes on phone.
  3. Do not store OTP in kiosk logs.
Previous sectionNext section
6
Section 6 of 8

Security

Checklist

  • HTTPS only for all calls
  • Secrets in environment variables or HSM
  • IP allowlist if available
  • Audit log on your side for each write call
  • Incident runbook for key compromise
  • Data minimization — fetch only fields needed
  • GDPR/local privacy — member consent for third-party sync

Common mistakes

MistakeRisk
Key in frontend bundlePublic theft
Shared key across vendorsCannot revoke one partner
No idempotency on paymentsDouble charge
Polling every secondRate limit ban
Previous sectionNext section
7
Section 7 of 8

Getting help

  1. Club Panel → Support — category Integration/API.
  2. Attach request/response correlation ID from error message — not secret key.
  3. Platform admin for capability enablement not listed in doc page.
Previous sectionNext section
8
Section 8 of 8

Summary for support

  • API docs live in Club Panel → Tools & Development → API documentation.
  • No raw URL paths in operator training — developers read panel docs directly.
  • Keys are club-scoped secrets — rotation and vault storage mandatory.
Previous sectionNext section