Help Center

Everything you need to know about setting up events, managing payments, and using TixFlow.

API for your CRM

Connect your CRM or reporting tools to TixFlow and read your events, orders, attendees and customers.

What the API gives you

A read-only REST API for your own data: events, orders (with their tickets), attendees (tickets with guest names and check-ins) and customers (everyone who bought from you, one entry per email address). The full reference is at /developers/api.

Creating a key

Portal → Settings → Integrations → API keys → Create key.

  • Give the key a name (for example "HubSpot sync") and choose what it may read.
  • Confirm that your organization is the controller of the buyer data you export.
  • Copy the key straight away – it is shown only once. If you lose it, revoke it and create a new one.

Only the owner of the organizer profile can create and revoke keys. A key reads only the data of the organizer it was created for.

Calling the API

Send the key in the Authorization header:

curl https://tixflow.org/api/v1/orders?createdFrom=2026-10-01T00:00:00Z \
  -H "Authorization: Bearer tf_live_…"

Lists return data, nextCursor and hasMore. While hasMore is true, call again with cursor=<nextCursor>.

Keeping your CRM in sync

Sort by updatedAt and keep the last nextCursor. Next time, send it back and you receive only what changed – new orders, refunds, check-ins.

# first run: everything, oldest change first
GET /api/v1/orders?sort=updatedAt
# store nextCursor; next run, only what changed since:
GET /api/v1/orders?sort=updatedAt&cursor=<stored nextCursor>
  • The same record can arrive twice – update by id instead of inserting.
  • Changes from the last few seconds appear on the next call.
  • Deletions are not reported.

Marketing consent

At every online checkout buyers can tick an optional box to receive news from you. The API returns their answer as marketingConsent: true, false, or null when they were never asked (door sales, older orders). The API exports all buyers regardless – you decide, as the controller, what the answer allows you to do.

Limits

120 requests per minute per key. Every response carries X-RateLimit-Remaining; when you hit the limit, wait for Retry-After seconds.