Organizer API

Every request carries an API key in the Authorization: Bearer txk_… header. The account owner creates keys on the Developers page of the panel; a key is shown only once and Tixvio stores only its hash.

A key belongs to one organizer and sees only the events that organizer hosts. A Tixvio Pro session doesn’t work on these endpoints, and an API key doesn’t work on the panel or Pro endpoints.

Validity is 30, 90 or 365 days, or no expiry. Up to 10 keys can be active at a time. Revoke keys you don’t use; revoking takes effect immediately.

curl https://tixvio.com/api/v1/ext/events?status=upcoming \
  -H "Authorization: Bearer txk_…"

• 120 requests per minute per key; above that you get 429 rate_limited with Retry-After: 60.
• Lists come in pages of 100 rows: ?page=1, 2, … If more is true in the response, there is a next page.
• Orders and attendees accept ?since=<ISO date> and return only what changed after that moment (payment, refund, new ticket, check-in); store the time of your last run when syncing.
• Amounts are integers in minor units (25000 = 250.00); the currency is in the currency field. Times are ISO 8601 (UTC).

{
  "events": [{
    "id": "clx…", "slug": "gece-…", "title": "…",
    "status": "PUBLISHED", "startsAt": "2026-11-21T19:00:00.000Z",
    "currency": "TRY", "sold": 412, "capacity": 600,
    "ticketTypes": [{ "id": "clt…", "name": "Genel", "price": 45000, "quantity": 500, "sold": 380 }]
  }],
  "page": 1, "more": false
}

POST https://tixvio.com/api/v1/ext/events/{id}/checkins
{ "items": [{ "code": "K7Q2…", "at": "2026-11-21T22:14:05Z", "mode": "scan" }] }

The QR on a Tixvio ticket changes every 30 seconds, so a screenshot soon becomes invalid. Format: TX2.<ticketCode>.<window>.<signature>.

window = floor(unix milliseconds / 30000). signature = the first 16 characters of the base64url text of HMAC-SHA256(key, ticketCode + "." + window). key is the row’s key field from the door list (as text, UTF-8).

Device clocks drift, so ±2 windows (about ±1 minute) are accepted. A row with an empty key (used, refunded, listed for resale) must not be admitted. The row’s win field is the [start, end] scan window; outside it, treat the ticket as OUT_OF_WINDOW.

Send entries made offline to the checkins endpoint once you’re online, so Tixvio Pro and the other doors won’t admit the same ticket twice.

// Node.js · list = GET /events/{id}/door
import crypto from 'node:crypto';
const rows = new Map(list.tickets.map((t) => [t.code, t]));

function verify(payload, now = Date.now()) {
  const [ver, code, w, sig] = String(payload).split('.');
  const row = rows.get(code);
  if (ver !== 'TX2' || !row || !row.key) return false;
  const win = Math.floor(now / 30000);
  if (Math.abs(Number(w) - win) > 2) return false; // EXPIRED
  const expected = crypto.createHmac('sha256', row.key)
    .update(`${code}.${w}`).digest('base64url').slice(0, 16);
  return expected === sig; // + row.win [from, to]
}

Downloaded per event from the Developers page of the panel (owners and managers). Columns: code, name, type, status, order, checked in. UTF-8 (BOM) with ; as separator, so Excel opens it correctly; cells starting with formula characters are neutralised.

Importing static barcodes sold elsewhere into the Tixvio door isn’t available yet: a static code can be shared as a screenshot, which defeats the dynamic QR protection. If you need it, write to us via live support.