Build on Gish.

REST + GraphQL APIs for wishes, group buys, outcome funds, contributions, and webhooks. OAuth 2.0 for third-party apps, API keys for first-party. Stable, versioned, and production-ready.

Authentication

Two methods. API keys for backend services and first-party tools. OAuth 2.0 for third-party apps acting on a user's behalf.

# API key · header
Authorization: Bearer gsk_live_a1b2c3d4...

# OAuth flow · authorize
GET https://gishme.com/oauth/authorize?
  client_id=YOUR_ID&
  redirect_uri=https://yourapp.com/cb&
  scope="wishes:read contributions:write"&
  state="random_csrf_token"

Scopes: wishes:read, wishes:write, contributions:read, contributions:write, profile:read, profile:write, webhooks:manage.

Your first call

Get the authenticated user's public profile:

curl https://api.gishme.com/v2/me \
  -H "Authorization: Bearer gsk_live_..."

# Response 200 OK
{
  "id": "usr_8a1f3b",
  "handle": "@alexgrant",
  "name": "Alex Grant",
  "verified": true,
  "plan": "plus",
  "created_at": "2024-03-12T14:22:00Z"
}

Wishes resource

Group buys

Outcome funds

Public wishlist widget

Embed a Gish user's top public wishes on any third-party page — your Ideal.Bio bio page, a personal site, a Notion doc with HTML blocks. The widget renders inside a shadow DOM (no CSS conflicts) and only ever exposes wishes with visibility=public. No auth required for either endpoint.

Drop-in snippet for any HTML page:

<script src="https://gishme.com/widget/wishlist-embed.js"
        data-handle="sona"
        data-limit="5"
        async></script>

Full instructions and a live preview: widget-embed-instructions.html.

Webhooks

Events POSTed to your registered URL. Body is JSON, signed with HMAC-SHA256 in X-Gish-Signature header.

Events shipped: 28 outbound events + 3 inbound Stripe events (Sprint 22L); 5 reserved by launch. Common outbound: wish.created, wish.updated, wish.variants_confirmed, pledge.received, goal.funded, goal.expired, booking.queued, booking.confirmed, group.opened, group.contribution_authorized, group.goal_met, group.charged, group.refunded, outcome.payee_verified, outcome.wired, contribution.created, profile.followed. Full list: llms.txt.

# Verify signature
const sig = req.headers['x-gish-signature'];
const expected = crypto
  .createHmac('sha256', WEBHOOK_SECRET)
  .update(req.rawBody)
  .digest('hex');
if (sig !== expected) throw new Error('Invalid signature');

Rate limits

Rate-limit headers: X-RateLimit-Limit, X-RateLimit-Remaining, X-RateLimit-Reset. 429 responses include a Retry-After header.

Official SDKs

Errors

Standard HTTP status codes. JSON error body:

{
  "error": {
    "code": "payee_unverified",
    "message": "Outcome fund payee must be verified before campaign launch",
    "docs": "https://gishme.com/api-docs.html#outcomes",
    "request_id": "req_8a1f3b9c"
  }
}

Common codes: auth_required, auth_invalid, scope_missing, resource_not_found, validation_error, rate_limited, payee_unverified, goal_already_met.

Partner integrations

Gish exposes endpoints for the partner-product layer. SKU-level verified-product lookups are integrated with The Ideal Code — Gish's QR + NFC product-identity partner — so brands registered with Ideal Code can serve verified badges on Gish wish pages and brand storefronts at gishme.com/@brand without writing custom integration code. Ideal Code is a separate company; Gish surfaces the verified signal under license.

Brand or platform integrations: email partners@gishme.com.