标签：#API

Skills are reusable workflows, not magic knowledge pills. Before you install one, inspect its source, versions, and effects to confirm it fits your project. Start with a few focused skills and adapt them to what already exists. A skill is a set of instructions and scripts that lets an agent reproduce a specialized method. It doesn’t guarantee best practices or compatibility with your repository. The official documentation for tools like Claude Code and Codex explains how skills work under the hood. Project rules, documentation, and skills serve different purposes. Official documentation describes technology features, repository conventions are captured in files like AGENTS.md , and skills provide reusable workflows. Mixing these roles leads to confusion and wasted context. Start your search in this order: official skills from the tool’s publisher, official technology docs, resources from recognized organizations, manually inspected community skills, and finally skills you create specifically for your project. Stars and downloads can signal adoption, but they don’t prove correctness. Before adding a skill, verify its origin, technical currency, possible actions, and compatibility with your project. Ask who maintains it, which versions it targets, whether it contains executable scripts, and whether it respects your existing architecture. If a script is unclear, don’t run it just because it comes with a skill. Contradictory skills increase noise and make decisions harder to explain. Two or three reliable workflows are more useful than a collection of twenty skills. For a mini-dashboard, start with a TypeScript review, a React and Next.js review, and a testing strategy tailored to expected behaviors. If no reliable skill matches your needs, write a short procedure adapted to your repository. A minimal skill can formalize a specific review, like verifying that a dashboard metric is typed, validated, displayed, and tested correctly. This keeps the workflow focused and rep

Your next API test tool might not be a smarter assertion library or a bigger suite of hand-written edge cases; it could be a free model you point at your endpoint and ask to misbehave on purpose. Manual boundary testing is slow because you tend to think of the inputs your code already expects, and traditional fuzzers generate a lot of noise without understanding what your API contract actually says. A language model sits in a useful middle ground: if you give it a short description of one endpoint, it can produce semantically plausible payloads that are likely to trip your parser, confuse your validation, or expose an error message you did not mean to send. That makes it a practical first line of defense, not a replacement for a security audit, and it works well enough for small services that would otherwise have no adversarial testing at all. Disclosure: This article was prepared as part of MonkeyCode's product outreach. The workflow below was written for any OpenAI-compatible endpoint, and it becomes easier to schedule when you use the free model access and free server option that motivated this test; I treat those availability claims as something to verify in your own setup rather than as a permanent promise. The core idea is to stop asking the model whether your API response is correct and start asking it to make your API fail. Take one endpoint from your own codebase, write down the fields it expects in plain language, and ask the model to generate a dozen request bodies that could break the server or bypass validation. You are not interested in the model's opinion of your code; you only want a stream of hostile inputs that your current tests probably miss. The script below sends each generated payload to a local target endpoint and prints the status code along with a short preview. A five-second timeout keeps one hanging request from blocking the rest, and those timeouts are often the most interesting results. import json , os , requests MODEL_ENDPOINT = os .

How I Bypassed NVIDIA's Phone Verification to Access 70+ Free AI Models from Bangladesh No VPN. No fake number. Just a browser console and an API call. If you are a developer in Bangladesh, you have probably hit the same wall I did. You go to build.nvidia.com , excited to try out the latest models on the NVIDIA NGC API. You click Generate API Key . And then — a phone verification gate appears. You look for your country code. Bangladesh is not on the list. NVIDIA says: "If your location isn't listed, please check again soon." I checked. It has been that way for a while. I am a student and independent builder from Dhaka, Bangladesh . I experiment with AI products and developer tools under the Alaminnna brand. I needed access to these models for a side project, not for enterprise production. Waiting for official support was not an option, so I looked for a legitimate workaround. Here is what I found. Table of Contents The Two Verification Gates Step 1: Create an Organization Account Step 2: Generate the API Key via Console Why This Works What You Actually Get Quick Test Final Thoughts The Two Verification Gates NVIDIA has two separate phone verification checkpoints: Account creation on the NVIDIA Build portal. API key generation inside the NGC dashboard. Both ask for a phone number. Both block Bangladesh. But here is the critical insight: the UI and the API are not the same system. The web interface enforces phone checks. The API itself does not. That gap is what makes this workaround possible. Step 1: Create an Organization Account (No Phone Needed) Personal NVIDIA accounts trigger phone verification immediately. Organization accounts, however, do not — at least not during the initial signup flow. Here is what I did: Go to build.nvidia.com/minimaxai/minimax-m3 . Click Generate API Key . Enter your email and create a password. Complete the hCaptcha verification. Check your email for a 6-digit verification code and enter it. On the "Almost Done" page, click Submit . You

security, #api, #ai, #cybersecurity A green CI/CD build means almost nothing to a regulator. Your AI hiring tool can pass every unit test, lint rule, and license scan, and still ship training labels from a sanctioned data broker. Legal only has to ask one question to turn that green pipeline red: who screened the vendors? High-risk AI systems need more than accurate models. A sanctioned supplier can poison your training data, cloud bill, or payment rail. The failure is usually not negligence; it is that compliance checks live in spreadsheets while the code lives in Git. A CI-ready sanctions helper in 40 lines I wanted the check inside the same pipeline that runs pytest. This helper screens a list of names against all five major sanctions lists and prints a markdown report that the CI runner can fail on. import os import sys import requests API_KEY = os . getenv ( " RAPIDAPI_KEY " ) if not API_KEY : sys . exit ( " RAPIDAPI_KEY is not set " ) URL = " https://sanctions-screener.p.rapidapi.com/screen " HEADERS = { " X-RapidAPI-Key " : API_KEY , " X-RapidAPI-Host " : " sanctions-screener.p.rapidapi.com " , } def screen_name ( name : str ) -> dict : try : r = requests . get ( URL , headers = HEADERS , params = { " name " : name }, timeout = 10 , ) r . raise_for_status () return r . json () except requests . exceptions . Timeout : return { " error " : f " timeout for { name } " } except requests . exceptions . RequestException as e : return { " error " : f " request failed: { e } " } def print_report ( name : str , result : dict ) -> None : print ( f " ## { name } " ) if " error " in result : print ( f " **ERROR:** { result [ ' error ' ] } " ) return verdict = result . get ( " verdict " , " UNKNOWN " ) print ( f " **Verdict:** { verdict } " ) matches = result . get ( " matches " , []) if not matches : print ( " - No matches " ) return for hit in matches : field = hit . get ( " matched_field " , " unknown " ) mtype = hit . get ( " match_type " , " unknown " ) tokens = hit .

Adding online payments to a web application can make it easier for customers to purchase products, subscribe to services, book appointments, or pay invoices. But payment integration involves more than adding a payment button to a website. A reliable integration needs a payment gateway, backend APIs, secure authentication, payment status handling, webhooks, and proper error management. This guide explains the basic process of integrating a payment gateway into a web application, using Razorpay as an example. 1. Understand How Payment Gateway Integration Works A typical payment flow looks like this: Customer → Web App → Backend → Payment Gateway → Bank/Payment Network The customer starts the payment from your website. Your backend creates the payment order through the gateway. The customer then completes the payment using a supported payment method. After the transaction, your application needs to confirm whether the payment was successful before providing the product or service. A simplified flow is: Customer selects a product or service. Your backend creates an order. The payment gateway generates the required payment details. Checkout opens for the customer. Customer completes the payment. The gateway returns payment information. Your backend verifies the payment. A webhook can update your system about payment events. Your database records the final payment status. The application confirms the order. 2. Choose the Right Payment Gateway Before starting development, compare payment gateways based on factors such as: Supported payment methods Transaction fees API documentation Developer tools Settlement process Refund support International payment support Webhook capabilities Security requirements Customer support For an Indian web application, gateways such as Razorpay can support common payment methods including UPI, cards, net banking, and wallets, depending on the account and applicable availability. The important thing is to choose a gateway that fits your applic

Expedia Group has open-sourced mockql-rs, a Rust CLI that fills @mock-annotated GraphQL fields with LLM-generated data at request time. It follows Airbnb's @generateMock in April and a GraphQL Foundation RFC opened in February. All three solve the same problem with different architectures, and two use the same directive name with incompatible semantics. By Steef-Jan Wiggers

TL;DR Today, there are numerous AI models, and it's important for businesses to be able to...

A single model can be unavailable, rate-limited, or temporarily slow. If your application already uses an OpenAI-compatible API, a simple fallback can make testing more resilient without introducing another SDK. This tutorial uses Node.js and the official OpenAI JavaScript package. It tries one model first and switches to a second model only when the first request fails. 1. Install the SDK npm install openai 2. Store the API key outside your code On macOS or Linux: export JINZEAI_API_KEY = "your_api_key_here" On PowerShell: $ env : JINZEAI_API_KEY = "your_api_key_here" Never commit a real API key. Rotate it immediately if it appears in a public repository, screenshot, or support message. 3. Create an OpenAI-compatible client import OpenAI from " openai " ; const client = new OpenAI ({ baseURL : " https://jinzeai.cc/v1 " , apiKey : process . env . JINZEAI_API_KEY , }); 4. Add a small fallback function const models = [ " deepseek-chat " , " qwen-flash " ]; async function completeWithFallback ( messages ) { let lastError ; for ( const model of models ) { try { const response = await client . chat . completions . create ({ model , messages , }); return { model , text : response . choices [ 0 ]. message . content , }; } catch ( error ) { lastError = error ; console . warn ( ` ${ model } failed: ${ error . status ?? " unknown status " } ` ); } } throw lastError ; } const result = await completeWithFallback ([ { role : " user " , content : " Explain model fallback in one sentence. " , }, ]); console . log ( `Model: ${ result . model } ` ); console . log ( result . text ); 5. Decide which errors should trigger fallback The minimal example retries on every error so the control flow is easy to see. A production application should be more selective. Fallback may be reasonable for: rate limits; upstream server errors; temporary timeouts; a model that is unavailable to the current account. Do not silently retry authentication errors. An HTTP 401 usually means the key is missing,

Vercel has made the v0 API generally available, enabling developers and AI agents to programmatically generate, iterate on, preview, and deploy applications through API calls. By Daniel Dominguez

With Truth API, Trump is "selling priority access to news he himself generates."

Retries are normal in distributed systems. A caller may time out after the server commits a decision, a queue may redeliver a message, or a webhook sender may repeat an event. A decision API that treats every request as new can double-charge, duplicate actions, or record conflicting outcomes. Give each business operation a stable key The idempotency key should identify the logical business request, not a network attempt. Store it with a normalized request fingerprint, processing state, outcome, rule version, and response. If the same key arrives with a different payload, reject it rather than returning an unrelated prior result. Handle concurrent duplicates atomically Two workers can receive the same key before either writes a result. Use a unique constraint, transaction, or compare-and-set operation so only one execution owns the request. Other attempts should wait, return an in-progress response, or read the completed outcome according to the API contract. Choose retention from business risk A short cache may stop immediate duplicates but fail when a delayed queue redelivers. A permanent record may create unnecessary storage or privacy burden. Document key expiry and what happens if a key is reused after that boundary. Put side effects behind the idempotent boundary If rule evaluation triggers a message or database write, use a transactional outbox or equivalent pattern so the decision and pending event are committed together. Consumers still need their own deduplication because downstream delivery is often at least once. Return decision provenance Include the decision ID, status, rule artifact version, timestamp, and whether the response was replayed. Do not regenerate a result under a newer rule version for a duplicate key unless the caller explicitly requests a new business operation. Test the failure modes, not only the happy path Cover concurrent duplicates, payload mismatch, worker crash after commit, delayed redelivery, key expiry, and downstream retry. Obs

يقوم Claude الآن بإرفاق بيانات تعريف العزو (provenance metadata) المشفّرة وفق C2PA بالملفات التي ينشئها. وينطبق الأمر نفسه على نماذج الصور من OpenAI و Gemini . هذا يعني أن إشارة العزو تصل سليمة إلى نقطة التحميل لأول مرة، لكن سلسلة معالجة الصور لديك قد تحذفها قبل أن يراها أي شخص. جرّب Apidog اليوم لا يحدث ذلك بنية سيئة؛ بل يحدث افتراضيًا. فمثلًا، تنشئ sharp().resize() ملفًا جديدًا بلا بيانات تعريف ما لم تطلب الاحتفاظ بها صراحةً. وينطبق ذلك أيضًا على ImageMagick وPillow ومعظم شبكات CDN الخاصة بالصور. يدخل الملف، ويخرج JPEG أصغر، ولا تخبرك السجلات أن بيانات العزو اختفت. هذه مشكلة قابلة للاختبار. ستتعلم هنا كيف تحدد المرحلة التي تحذف بيانات C2PA، وتثبت ذلك عبر رحلة رفع وتنزيل حقيقية، وتضيف فحصًا في CI يمنع عودة المشكلة. يتولى Apidog تنسيق سيناريو الـ API، بينما يتولى c2patool التحقق من صحة البيانات على مستوى البايت. ما الذي يتم تدميره بالفعل؟ بيان C2PA هو كتلة موقعة تشفيريًا ومضمّنة داخل حاوية الملف. يسجل من وقّع الأصل وما الذي ادعاه عنه. وبما أنه موقّع، فإن تغيير البايتات دون إعادة التوقيع يكسر التوقيع بطريقة يستطيع أي مدقق اكتشافها. النقطة المهمة هنا هي حاوية الملف : عندما تعيد كتابة الحاوية، قد يختفي البيان. العملية هل يبقى البيان افتراضيًا؟ نسخ أو نقل بايت ببايت نعم sharp().resize().toBuffer() لا ImageMagick عبر convert أو magick لا Pillow عبر Image.save() لا تحويل PNG إلى WebP أو JPEG إلى AVIF لا التحسين التلقائي في CDN للصور غالبًا لا لقطة شاشة لا إعادة الحفظ من محرر صور لا رفع إلى S3 دون تحويل نعم كل عنصر في عمود لا هو إجراء شائع في تطبيقات الويب: إنشاء صور مصغرة، توليد صور متجاوبة، التفاوض على التنسيق، أو إزالة EXIF لأسباب الخصوصية. كل خطوة منطقية بمفردها، لكنها قد تنهي سلسلة العزو بصمت. انتبه أيضًا إلى أن استخدام -strip لإزالة بيانات EXIF قد يكون مقصودًا، لأن EXIF قد يحمل إحداثيات GPS أو أرقامًا تسلسلية للكاميرا. لكن إزالة جميع البيانات الوصفية للتخلص من بيانات الموقع تزيل بيان C2PA كذلك. الحل هو إزالة البيانات الحساسة بشكل انتقائي، لا حذف الكتلة كاملة. أثبت المشكلة في دقيقتين قبل تغيير خط الأنابيب، تحقق من وجود المشكلة فعلًا. تحتاج إلى ملف واحد يحتوي على بيان

Roblox exposes game and group stats through public, unauthenticated endpoints — no login, no scraping tricks: GET https://games.roblox.com/v1/games?universeIds=<id>,<id>,... GET https://games.roblox.com/v2/groups/<groupId>/games?limit=50 I used them to pull the full public games list for a few independent creator groups that each ship multiple games in the same cheap-to-build "obby" template genre (think: dozens of studios building the same core traversal loop with a different skin). The question was simple: within one studio's own catalog, how concentrated is traffic in the single best title versus everything else they've shipped? The answer is the same shape every time: a small number of throwaway builds with near-zero traffic, and one outlier that accounts for nearly all of the studio's lifetime visits. Not "most games do okay and one does great" — more like one game is the studio, traffic-wise, and the rest are lottery tickets that didn't hit. As a sanity check against numbers that are already public knowledge (no anonymity concern), I ran the same script against Uplift Games' group (id 295182): $ python3 fetch_group_stats.py 295182 Group 295182: 371 published experiment(s) Total lifetime visits across all games: 44,412,921,224 Top title alone: 44,377,094,324 visits (99.9% of the group's total traffic) Visit-count distribution: 0-10K: 355 game(s) 10K-500K: 12 game(s) 500K-5M: 2 game(s) 5M-50M: 1 game(s) > 50M: 1 game ( s ) One title (Adopt Me) is 99.9% of that group's entire lifetime traffic across 371 shipped experiments. Same power-law concentration as the smaller, anonymized groups in the full writeup — just at a much larger scale. Why this is more than a curiosity : if you're building in a genre like this, the template itself is clearly not the moat — everyone in it ships near-identical mechanics. The variance between a 45-visit build and a 700M-visit build using the same template looks like it's mostly about timing and whatever the discovery algorithm rewar

Yulu aims to have a fleet of 200,000 bikes in the next two years and faster electric two-wheelers, aiming at new logistics use cases.

If you clip short-form video for money, you know Whop Content Rewards: hundreds of live campaigns paying $0.15–$20 per 1,000 views. The discover page lets you sort by budget. That sort is quietly costing you nights of work. Here's the number that changed how I pick campaigns: on the live board right now, 21% of active campaigns have never paid out a single cent. Big banner budget, $0 actually spent. A "$30,000 budget" campaign that has paid nobody in three weeks is not a $30,000 opportunity — it's a landing page. The problem: the board doesn't show you payout speed. You can see budget and budget left , but not how fast the money is actually moving — and that's the only number that separates a campaign that pays from a campaign that poses. The trick: the page already contains everything you need Every campaign card on Whop publishes three things: when it was funded, how much has been spent, and how many creators joined. From one snapshot — no monitoring, no state between runs — you can derive: dailyBurnUsd = budgetSpent / daysSinceFunded → is money moving? estimatedDaysLeft = budgetLeft / dailyBurnUsd → will it still be there? payoutPerCreatorUsd = budgetSpent / creators → what did the average clipper earn? budgetPace = "draining" | "healthy" | "slow" | "stalled" That last field is the shortcut. On today's board of 456 campaigns: pace meaning what to do draining <3 days of budget left skip — gone before your clip gains traction healthy 3–60 days this is where you clip slow 60–180 days fine, but budget may outlive the campaign stalled >180 days at current burn the "big budget" mirage — money posted, almost nobody paid null zero paid out so far unproven; could be brand new, could be dead Real example from today: two campaigns, both showing ~$30K budget. One burns $255/day and has paid the average creator $75 . The other burns $19/day — at that rate its budget lasts four years , which is a polite way of saying nobody is getting paid. On the default board they look ident

We shipped an MCP server for WhatsApp link generation — no API key required If you've ever needed an AI agent to validate a WhatsApp number, build a wa.me link, or generate a QR code on the fly, you've probably hand-rolled it: scrape a regex off Stack Overflow, write your own phone-format validator, maybe hit some undocumented endpoint. We got tired of watching that happen and shipped a small, open MCP server that does it directly. What it is WhatsUsernames.link already runs a free public REST API for validating WhatsApp usernames/phone numbers and generating wa.me links + QR codes. We just exposed the same logic over the Model Context Protocol , so Claude, and any other MCP client, can call it as native tools instead of you writing a fetch wrapper. Endpoint: https://whatsusernames.link/api/mcp No API key. No account. No signup form. Same open, IP-rate-limited model as the REST API (60 req/min for JSON tools, 20 req/min for QR generation, sliding window via Upstash Redis). The five tools Tool What it does validate_username Checks WhatsApp username ( @username ) format validate_phone Checks phone number format (8–15 digits, international) username_link Builds a wa.me link (+ short link) from a username, optional prefilled text phone_link Builds a wa.me link from a phone number, optional prefilled text qr_code Renders a QR code (PNG or SVG) for a wa.me link, custom size/colors Every tool wraps the exact same services/ and validate-* functions the REST API uses — there's no separate business logic to drift out of sync. If the REST endpoint says a number is valid, the MCP tool agrees, because it's the same code path. Connect it Drop this into your MCP client config: { "mcpServers" : { "whatsusernames" : { "url" : "https://whatsusernames.link/api/mcp" } } } That's it. No stdio process to spawn, no local install — it's a stateless Streamable HTTP transport running on Vercel, same domain as the site. Why build this Two reasons. Practical: every agent that needs to hand a u

Sometimes your application can reach an external service from one server, but not from another. I ran into this problem while working on one of my projects. I needed my server in Iran to communicate with Telegram, but the connection wasn't reliable from inside Iran. Instead of moving the whole application, I built a small intermediate service: Signed Webhook Receiver It is a lightweight FastAPI service that receives requests signed with an RSA private key and verifies them using the corresponding public key before processing them. Your Server | | RSA Signed Request v Webhook Receiver | | HTTP Request v External Service The receiver can be useful for: Secure server-to-server communication Webhooks and internal APIs Acting as a controlled proxy/gateway Connecting servers across different network environments Payment integrations where a provider requires requests from an Iranian IP For example, if your main application is hosted outside Iran but a payment gateway only accepts requests from Iranian IP addresses, an Iranian server can act as the intermediate gateway: Foreign Server | | Signed Request v Iranian Gateway Server | v Payment Gateway The important part is that this isn't an open proxy. Requests can be authenticated and the gateway can be restricted to specific operations and destinations. The project is built with Python, FastAPI, Cryptography, Docker, and Traefik and is open source. View the project on GitHub I also wrote more technical notes and development articles on my website: Building a Secure Webhook Receiver for Server-to-Server Communication | CyberHuginn

REST works great while your API describes resources. But as soon as the domain becomes verb-shaped - recalculateInvoice , mergeAccounts , assignTask - you end up bending verbs into nouns and arguing about which HTTP method cancels an order. JSON-RPC 2.0 cuts through all of that: every call is just method + params , one endpoint, a spec that fits on two pages, and batching out of the box. In this article we will build a working JSON-RPC 2.0 API on Symfony: a task tracker with DTO validation, batch requests and generated OpenAPI documentation. There is surprisingly little code to write: methods are declared with attributes, validation is derived from property types, and Swagger is generated by a console command. Everything below lives as a ready-to-run project on GitHub: symfony-jsonrpc-api-demo - clone it and poke it with curl while you read. We will use the otezvikentiy/json-rpc-api bundle (PHP 8.2-8.5, Symfony 6.4/7/8; this article uses PHP 8.4 and Symfony 7.4). Full disclosure: I am the author of the bundle. It has been running in production for three years - internal fintech tooling, an HRM system - nothing glamorous load-wise, but the correctness, logging and audit requirements were real, and they shaped most of what you will see below. Installation composer create-project symfony/skeleton: "7.4.*" tasks-api cd tasks-api composer require otezvikentiy/json-rpc-api If Flex has contrib recipes enabled, the bundle registers itself. If not, it is two lines by hand: // config/bundles.php return [ // ... OV\JsonRPCAPIBundle\OVJsonRPCAPIBundle :: class => [ 'all' => true ], ]; Wire up the route and a minimal config: # config/routes/ov_json_rpc_api.yaml ov_json_rpc_api : resource : ' @OVJsonRPCAPIBundle/config/routes/routes.yaml' # config/packages/ov_json_rpc_api.yaml ov_json_rpc_api : access_control_allow_origin_list : - ' http://localhost:8000' The bundle registers a single route, /api/v{version} - every request goes through it. Note the CORS list format: these are ful

🚀 Shipping a major update to my portfolio After weeks of designing, developing, and refining, I'm excited to share the latest version of my personal portfolio. Rather than building another static portfolio, I wanted to treat it like a real product—focusing on performance, interaction design, accessibility, analytics, and user experience. 🌐 Live: https://www.alanbabychan.online What I built 🟩 Matrix Theme A cyberpunk-inspired dark mode featuring animated binary effects, glowing UI elements, and an immersive developer experience. ⬜ Paper Theme A clean, modern light mode designed with readability, visual hierarchy, and clarity in mind. 🎵 Interactive Audio System •Background music •UI sound effects •Dedicated settings panel •Adjustable volume controls •Built using the Web Audio API 🖱️ Interactive Cursor A custom mouse-follow glow and subtle cursor interactions that enhance the browsing experience without becoming distracting. ✨ Micro-interactions Hover states, smooth page transitions, animated UI components, and responsive visual feedback to make every interaction feel intentional. 📖 UX & Accessibility Built around clear typography, intuitive navigation, responsive layouts, and accessibility-focused design to provide a consistent experience across devices. 📊 Performance & Analytics Built with Next.js and optimized for speed, SEO, and scalability. Implemented a complete Google Analytics 4 setup including: •SPA page tracking •Google Consent Mode v2 •Custom event tracking •User interaction analytics Tech Stack: Next.js • React • Tailwind CSS • Framer Motion • Web Audio API • Google Analytics 4 • Microsoft Clarity Coming Soon... 👀 I'm currently building a personal AI assistant that will allow visitors to interact with my portfolio, ask questions about my projects, experience, and skills, and explore everything conversationally. What I learned This project pushed me to dive deeper into: •Theme architecture •Frontend performance optimization •Animation systems •Custom UI inte

Receiving a webhook is easy. Building a webhook pipeline that survives duplicate deliveries, delayed events, missing messages, invalid signatures, and seller authorization changes is the real engineering work. This guide explains how to build a production-ready pipeline for TikTok Shop Customer Service messages—from HTTPS ingress to history reconciliation. First, Understand the Scope TikTok Shop Customer Service API is designed for conversations between buyers and sellers in a TikTok Shop. It is not an API for reading ordinary TikTok direct messages. Before implementation, confirm that: Your application has access to the required Customer Service API scopes. The seller has authorized your application. The target shop is correctly mapped to your internal workspace or tenant. Your webhook endpoint is publicly accessible over HTTPS. Customer Service API access is inactive by default and requires approval. See the official Customer Service API overview and app features documentation . If these prerequisites are missing, changing webhook code will not solve the problem. Recommended Architecture A reliable implementation separates webhook acknowledgement from business processing: TikTok Shop | v HTTPS webhook ingress | +-- Verify signature using raw request body | +-- Insert event into a durable inbox | +-- Return HTTP 200 within 3 seconds | v Message queue | v Normalize, deduplicate, and route | v Customer service workspace ^ | History reconciliation worker The webhook request should not wait for: CRM updates AI-generated replies Media downloads Ticket creation Search indexing External notifications Persist the event, acknowledge it, and process it asynchronously. Subscribe to the New Message Event For incoming customer service messages, subscribe to NEW_MESSAGE , identified as event type 14 . You can configure the subscription in TikTok Shop Partner Center or through the webhook configuration API. The official event reference is available in the New Message webhook docu