Pricewatcha

Pricewatcha API

The Pricewatcha API is the Structured Product Price Intelligence Platform for developers, automation and AI Agents.

The Pricewatcha API derives from the pricewatcha.com application. It provides price tracking, alerts and product intelligence beyond the Pricewatcha dashboard. This repository documents the public HTTP API, OpenAPI schema, official SDKs, MCP server and examples. It does not contain the production web application or scrapers.

Status: Available · Version: v1 · Base URL: https://pricewatcha.com/api/v1

Interactive API keys (browser): Profile & API Keys

---

Optional: verify connectivity with GET https://pricewatcha.com/api/v1/health. Then pick one of the three paths below.

Quickstart

Path 1: Browse prices (no auth)

Use demo product IDs from the demo catalog or search the catalog:

curl -s "https://pricewatcha.com/api/v1/products/demo_iphone_15_pro"

curl -s "https://pricewatcha.com/api/v1/search?q=iphone+15&limit=10"

Search is case-insensitive token AND (all terms must appear; word order does not matter). Results include the full Pricewatcha catalog, not only URLs submitted via POST /track. Use product_id from search for product and price-history endpoints (prod_* or demo_*).

Path 2: Track a product and get price history

curl -s -X POST "https://pricewatcha.com/api/v1/track" \

-H "Content-Type: application/json" \ -d '{"url": "https://www.backmarket.de/de-de/p/example-product"}'

curl -s "https://pricewatcha.com/api/v1/products/{productId}/price-history"

POST /track returns HTTP 200 with a bounded server-side long-poll (~25s). Use product_id from the response for price history. Optional: send Authorization: Bearer pwk_live_… for higher track, search and product-read quotas.

Fast shops return status: "completed" with the full product in one call. Slow shops return status: "running" with a job_id. Poll GET https://pricewatcha.com/api/v1/jobs/{jobId} until the job is completed or failed. More detail: Async track & poll.

Path 3: Price alert with webhook (API key required)

Create a key in Profile & API Keys, then:

curl -s -X POST "https://pricewatcha.com/api/v1/alerts" \

-H "Authorization: Bearer pwk_live_YOUR_KEY" \ -H "Content-Type: application/json" \ -d '{ "product_id": "prod_a1b2c3d4e5", "notify_on_drop": true, "min_threshold_price": 500.00, "webhook_url": "https://your-n8n-instance.com/webhook/abc", "notify_email": true }'

For authentication and data boundaries, see Authentication and Data boundaries.

---

Authentication

No credential required for catalog search, product detail, price history and async track/poll. Without a key those endpoints use anonymous rate limits. Send an API key to use the higher per-account track, search and product-read quotas.

Protected API v1 endpoints (alerts, webhooks, authenticated track callbacks) use:

Authorization: Bearer pwk_live_…

Do not use the login session token for alerts, webhooks or other API v1 calls once you have an API key.

See Access model for which routes are public vs authenticated.

---

API keys (browser)

Log in and open Profile & API Keys to create and manage API keys in your browser. The full secret is shown once at creation.

For agents without a browser, use headless key bootstrap below.

Using your key on protected endpoints:

curl -s -X POST "https://pricewatcha.com/api/v1/alerts" \

-H "Authorization: Bearer pwk_live_YOUR_KEY" \ -H "Content-Type: application/json" \ -d '{"product_id": "prod_a1b2c3d4e5", "notify_on_drop": true}'

---

Headless key bootstrap (for agents)

If an agent must obtain API credentials without a browser, authenticate once with the same email and password as on the website, create an API key, then use pwk_live_… for all further calls. This is not a separate agent login: it is the normal Pricewatcha account login exposed as an HTTP endpoint.

How login via API works

POST https://pricewatcha.com/api/auth/login accepts JSON email and password and returns a short-lived access_token (login session token). The Developer page login modal calls the same endpoint; in a script or agent you call it directly with curl or your HTTP client.

• You need an existing account (register on the site or via POST https://pricewatcha.com/api/auth/register).
• The email must be verified: otherwise the API returns 403.
• Wrong credentials return 401.
• Use access_token only to create keys; for alerts and webhooks use the pwk_live_… key from step 2.

Step 1: Login

curl -s -X POST "https://pricewatcha.com/api/auth/login" \

-H "Content-Type: application/json" \ -d '{"email": "you@example.com", "password": "YOUR_PASSWORD"}'

Response (HTTP 200), AuthResponse:

• access_token (string): login session token (JWT)
• token_type (string): always "bearer"
• user (object): id (string, UUID), email (string), email_verified (boolean)

{

"access_token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...", "token_type": "bearer", "user": { "id": "a1b2c3d4-e5f6-7890-abcd-ef1234567890", "email": "you@example.com", "email_verified": true } }

Send the token as Authorization: Bearer in step 2. Session tokens expire; do not store them as the long-term credential for an agent.

Step 2: Create API key

curl -s -X POST "https://pricewatcha.com/api/keys" \

-H "Authorization: Bearer ACCESS_TOKEN_FROM_STEP_1" \ -H "Content-Type: application/json" \ -d '{"name": "agent bootstrap"}'

Response (HTTP 200), CreateApiKeyResponse:

• id (integer): key ID
• name (string): label from the request
• key_prefix (string): first 12 characters of the key (for display)
• key (string): full secret; returned only on create, not on list
• is_active (boolean)
• created_at (string, ISO 8601 datetime)
• last_used_at (string or null)
• revoked_at (string or null)

{

"id": 42, "name": "agent bootstrap", "key_prefix": "pwk_live_ab", "key": "pwk_live_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx", "is_active": true, "created_at": "2026-05-27T14:30:00.123456", "last_used_at": null, "revoked_at": null }

Store key securely. Use it on alerts, webhooks and other protected API v1 endpoints, not the session token from step 1.

---

API endpoints (overview)

Machine-readable contract: openapi/openapi.yaml · Live: GET https://pricewatcha.com/api/v1/openapi.json

---

Rate limits

Current limits (indicative)

The following limits apply and may change without notice.

Send Authorization: Bearer pwk_live_… on POST /track, GET /search, or product reads to use the authenticated tier. Those endpoints remain available without a key at the anonymous limits.

Client identity: anonymous limits are keyed by client IP. Behind Cloudflare the API prefers CF-Connecting-IP over X-Forwarded-For so edge proxy IPs are not treated as distinct clients. The hosted MCP server forwards a stable X-Pricewatcha-Client-Id (OAuth token hash, else connecting-IP hash) with a shared proxy secret so MCP callers are not all bucketed under one egress IP. Authenticated track, search and product-read quotas are keyed by account (owner_id), not IP.

Monitor X-RateLimit-Remaining and honor 429 with exponential backoff. X-RateLimit-Policy names which window the headers refer to (track, track_hourly, track_daily, track_concurrent, job_read, search, search_hourly, search_daily, read, read_hourly, or read_daily).

Track quotas are counted from persisted jobs (api_track_jobs by client key or account), so they apply across multiple app instances. A long-poll that holds the HTTP connection for ~25s still counts as one track job when created — sequential tracks spaced farther apart than 60s will not trip the burst window, but hourly/daily and concurrent caps still apply.

Agents should prefer: start track → poll GET /jobs/{id} with backoff (not every 1–2s) → read product/history once complete. Retrying POST /track with the same URL while that job is still queued/processing reuses the existing job and does not consume another concurrent slot. Jobs left queued/processing longer than the scrape timeout (default 600s) are failed so slots cannot leak across deploys.

Search and product-read quotas are in-memory per app instance (not shared across Railway replicas the way track jobs are). Authenticated callers still get the higher per-account windows. Polling the same catalog queries on a short interval will still trip the hourly/daily search windows.

Exact numbers may change without notice (env overrides: API_V1_TRACK_*, API_V1_TRACK_AUTH_*, API_V1_JOB_READ_*, API_V1_READ_*, API_V1_READ_AUTH_*, API_V1_SEARCH_*, API_V1_SEARCH_AUTH_*).

Headers

When rate limiting is active, responses may include: