Reseller program

Sell Curialy from your own Telegram bot or website

Approved resellers create X Premium orders through the Curialy API at their own customer price. Your customer pays Curialy's payment address directly, Curialy delivers the plan, and you earn the referral commission plus your markup when the order is Completed.

Open your affiliate wallet to apply

How it works

01
Create an affiliate account
Use the same Curialy affiliate wallet that holds referral rewards. Reseller earnings land in the same wallet.
02
Apply for reseller access
Tell us your business name, where you sell (a Telegram bot or website) and how to reach you. The operator reviews every application manually.
03
Set prices and create an API key
Choose your customer price for each plan, then create a server-side API key. Optionally add a webhook URL for signed order updates.
04
Integrate and sell
Create orders, show the payment address and exact amount, submit the customer's transaction hash, and follow the order status until it is Completed.

How the money works

Curialy always keeps the list price minus the referral commission. Anything your customer pays above that is yours. Customers never pay you directly for these orders, so there is nothing to forward to Curialy.

Plan	Curialy list price	Commission	Example price	You earn	Curialy keeps
3 months	$4.50	$1.00	$6.00	$2.50	$3.50
6 months	$8.00	$1.50	$10.00	$3.50	$6.50

Minimum price is the Curialy list price; maximum is 3× the list price. Selling at the list price earns exactly the referral commission.

Rules that protect your customers

Customers pay the Curialy network, coin, address and exact amount returned by the API. Never ask a customer to pay you for an API order.
Collect the same confirmations as the Curialy checkout: the customer's current X subscription is none or Basic, the @handle is the account to receive the plan, the account is in good standing, and they accept Curialy's service terms and privacy notice.
Earnings are credited only when the order is Completed, and are reversed if a completion is reversed. Withdrawals use the existing manual review.
Referral promo codes cannot be combined with reseller orders.
Do not present yourself as X or an official X partner. The Curialy payment page tells customers which reseller sold the order.
API keys are secrets for your server or bot only. The operator can suspend API access; orders already placed still complete normally.

API reference

JSON over HTTPS. Amounts are USD decimal strings such as "6.00". Send your key in the Authorization header from your server. Browser calls are not supported.

Base URL:      https://curialy.com/api/reseller/v1
Authorization: Bearer cly_live_xxxxxxxx_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

GET	/me	Your reseller profile, prices, wallet and sales totals.
GET	/catalog	Plans with your price, limits and earnings, plus supported payment networks and coins.
POST	/orders	Create an order. Send an Idempotency-Key header so retries never create a duplicate.
GET	/orders	List your orders. Filters: status, externalRef, limit (max 100), cursor.
GET	/orders/{code}	One order with its status history and your earnings.
POST	/orders/{code}/payment	Choose network and coin. Returns the Curialy address and exact amount to pay.
POST	/orders/{code}/submit	Submit the customer's transaction hash for manual confirmation.
GET	/orders/{code}/receipt.png	The order receipt image, for example to send in Telegram.
POST	/webhooks/test	Send a signed test event to your webhook URL.

Errors

Errors return {"error": message, "code": code}. Codes: invalid_request (400), unauthorized (401), forbidden (403), not_found (404), conflict (409, for example an Idempotency-Key reused with a different body), rate_limited (429), server_error (500).

Order statuses

awaiting_payment → pending (hash submitted) → confirming → completed. Orders can also become rejected, or expired if no payment is submitted within 30 minutes.

Create and pay an order

curl -X POST https://curialy.com/api/reseller/v1/orders \
  -H "Authorization: Bearer $CURIALY_API_KEY" \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: tg-123456789-0001" \
  -d '{
    "items": [{ "productId": "x-premium", "planId": "x-3", "quantity": 1 }],
    "xHandle": "customer_handle",
    "externalRef": "tg:123456789",
    "checks": { "subscription": "none", "recipient": true,
                "goodStanding": true, "terms": true }
  }'

# 201 → { "order": { "orderCode": "CLY-…", "status": "awaiting_payment",
#   "totalUsd": "6.00", "earnings": { "totalUsd": "2.50", "state": "pending" },
#   "paymentUrl": "https://curialy.com/pay/CLY-…", … } }

curl -X POST https://curialy.com/api/reseller/v1/orders/CLY-…/payment \
  -H "Authorization: Bearer $CURIALY_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{ "network": "bnb", "coin": "USDT" }'
# → order.payment = { "network", "coin", "address", "amount" }

curl -X POST https://curialy.com/api/reseller/v1/orders/CLY-…/submit \
  -H "Authorization: Bearer $CURIALY_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{ "txHash": "<customer transaction hash>" }'

Webhooks

When one of your orders changes status, Curialy sends POST requests with an order.status_changed event to your https:// URL. Each request carries Curialy-Event, Curialy-Delivery and Curialy-Signature headers. The signature is HMAC-SHA256 of "{timestamp}.{raw body}" with your signing secret. Reply with any 2xx status. Failed deliveries are retried for about a day. Use Curialy-Delivery to ignore duplicates.

import crypto from "node:crypto";

// rawBody must be the exact bytes received, before JSON parsing.
export function verifyCurialySignature(rawBody, header, secret, toleranceSec = 300) {
  const parts = Object.fromEntries(header.split(",").map((p) => p.split("=")));
  const timestamp = Number(parts.t);
  if (!timestamp || Math.abs(Date.now() / 1000 - timestamp) > toleranceSec) return false;
  const expected = crypto.createHmac("sha256", secret)
    .update(`${timestamp}.${rawBody}`).digest("hex");
  const given = Buffer.from(String(parts.v1 ?? ""), "utf8");
  const wanted = Buffer.from(expected, "utf8");
  return given.length === wanted.length && crypto.timingSafeEqual(given, wanted);
}

After approval, ask @Curialy on Telegram for the starter code: a Telegram bot and a small website checkout that use this API.