Send orders with the order API

Varly only receives the orders your shop sends after you connect. Older orders are not imported.

Use the order API if your shop doesn't run on Shopify, or if you prefer to send orders yourself. Orders always come from your shop's server, never from the visitor's browser, so nobody can add fake orders from the outside.

Create an API key

1. Open Install in the menu on the left and scroll to 5. Connect your orders. If you picked a platform without a shop under 1. (such as WordPress or Webflow), open My site does sell online first.
2. Click Create API key.
3. Copy the key right away. Varly shows it only once: "New key created. Copy it now: it is not shown again."
4. Give the key to your developer through a safe channel. Treat it like a password.

After that, Varly shows Active key ending in … with the last characters of the key. Varly doesn't store the key itself, only a fingerprint of it, so it can't show the key again.

Replace or revoke a key

• Create new API key: makes a new key. The current key stops working right away, so update your shop's server at the same moment. Use this if the key may have leaked.
• Revoke API key: turns the key off. Orders sent with it are refused from now on, until you create a new one.

Each site has one active key at a time.

What your developer needs to do

1. On the website: when a visitor checks out, read the visitor ID and session ID from the snippet with Varly.ids(), and save them with the order (for example in a hidden field or the order's metadata).
2. On the server: after the order is placed, send it to Varly with the API key, including those two IDs.

Orders without the IDs still count in the order total on Install → 5. Connect your orders. They don't count in Click impact, A/B tests or the order filters, because Varly can't tell which visit they came from.

Common problems

Varly answers "Invalid site or API key". The key is wrong, was replaced with Create new API key, or was revoked. Also check that the address ends with the right site key.

Orders arrive but aren't linked to visits. The IDs are missing or empty. See Orders are not linked to visits.

We sent the same order twice by mistake. No problem: Varly counts each order_id once, even if you send it again. So your developer can safely retry a request that failed.

An order was refunded or canceled. Send the order again with the same order_id and created_at, and the new total as revenue (0 for a canceled order). The newest version replaces the old one. Always send the same created_at as the first time: that keeps it the same order.

For developers

Endpoint. Copy the exact address from Install → 5. Connect your orders. It has this shape:

POST https://app.varly.ai/api/orders/{site key}
Authorization: Bearer sk_…
Content-Type: application/json

Body. Send one order as an object, or up to 100 orders as {"orders": [ … ]}. The body can be at most 1 MB.

Field	Required	What to send
order_id	Yes	Your order number, as a string or number. Letters, digits and _ . : # -, up to 100 characters. Sending the same order_id again doesn't create a second order.
revenue	Yes	Order total as a number, for example 59.95. Zero or more. Rounded to two decimals.
currency	Yes	Three-letter code in capitals, for example EUR or USD.
items	No	Number of items in the order.
visitor_id	No, but needed for linking	visitorId from Varly.ids().
session_id	No, but needed for linking	sessionId from Varly.ids().
created_at	No	Order time as an ISO 8601 string, for example 2026-11-04T12:00:00Z. Times in the future or more than a year ago are replaced by the time Varly received the order. Without it, Varly uses the time it received the order.

Reading the IDs on your site.

const ids = window.Varly && window.Varly.ids()
// { visitorId: "…", sessionId: "…" }, or null

Varly.ids() returns null when the snippet isn't measuring on that page, for example because the visitor hasn't accepted cookies, or on pages listed under Never track these pages. Read the IDs on a page before the checkout, for example when a product is added to the cart on a product page. Not on the checkout itself, and not on the cart page while /cart is on Never track these pages (it is by default). An ID that isn't 8 to 64 letters, digits, _ or - is ignored, and the order is saved without a link.

Example.

curl -X POST https://app.varly.ai/api/orders/pk_your_site_key \
  -H "Authorization: Bearer sk_…" \
  -H "Content-Type: application/json" \
  -d '{"orders":[{"order_id":"1001","revenue":59.95,"currency":"EUR","items":2,
       "visitor_id":"…","session_id":"…","created_at":"2026-11-04T12:00:00Z"}]}'

Responses.

Status	Body	Meaning
200	{"received": 1}	The orders were saved.
400	{"error": "…"}	Something in the body is wrong. The message says what, for example currency must be a three-letter code like EUR for order 1001. If one order in a batch is invalid, none of the batch is saved.
401	{"error": "Invalid site or API key"}	Wrong key or site address.
413	{"error": "The request is larger than 1 MB. Send fewer orders per request."}	The body is larger than 1 MB. Send fewer orders per request.