Create a test account
curl --request POST \
--url https://catchbackcards.com/api/partner/v1/test-accounts \
--header 'Authorization: Bearer <token>'import requests
url = "https://catchbackcards.com/api/partner/v1/test-accounts"
headers = {"Authorization": "Bearer <token>"}
response = requests.post(url, headers=headers)
print(response.text)const options = {method: 'POST', headers: {Authorization: 'Bearer <token>'}};
fetch('https://catchbackcards.com/api/partner/v1/test-accounts', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://catchbackcards.com/api/partner/v1/test-accounts",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"net/http"
"io"
)
func main() {
url := "https://catchbackcards.com/api/partner/v1/test-accounts"
req, _ := http.NewRequest("POST", url, nil)
req.Header.Add("Authorization", "Bearer <token>")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://catchbackcards.com/api/partner/v1/test-accounts")
.header("Authorization", "Bearer <token>")
.asString();require 'uri'
require 'net/http'
url = URI("https://catchbackcards.com/api/partner/v1/test-accounts")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Bearer <token>'
response = http.request(request)
puts response.read_body{
"account": {
"user_id": "3b0e0000-…",
"email": "acme-9f2c41ab@test.catchbackcards.com",
"password": "x7Qe…",
"username": "swiftFalcon4821",
"balance": 10000,
"created_at": "2026-10-21T18:00:00Z",
"expires_at": "2026-11-20T18:00:00Z",
"active": true
},
"sign_in": {
"web": "https://catchbackcards.com/auth",
"note": "Sign in with email and password. The account is confirmed and phone-verified already."
}
}{
"error": "Missing or malformed API key"
}{
"error": "<string>",
"code": "<string>"
}{
"error": "<string>",
"code": "<string>"
}{
"error": "<string>",
"code": "<string>"
}{
"error": "<string>",
"code": "<string>"
}{
"error": "<string>",
"code": "<string>"
}Testing
Create a test account
Scope: create:test_accounts, opt-in, granted on request. Changes data.
Makes a separate CatchBack login, already confirmed and phone-verified, with a $10,000 test balance that lasts 30 days. Each key can have 5 active at a time. There’s no body, and the key doesn’t have to be linked to an account. The password is shown once.
A test account is a login, not a key. Sign in with it to use it: your API calls keep acting on your key’s account and spending its real balance. It can open packs up to the Diamond tier, other than the Starter, the sealed mystery packs and the Steph Curry pack, and sell back. It can’t use the marketplace, gifts, drops, battles, shipping, chat or DMs, or withdraw. Pulls come from the live pool, and anything it still holds returns there daily at 10:00 UTC. See Testing.
POST
/
api
/
partner
/
v1
/
test-accounts
Create a test account
curl --request POST \
--url https://catchbackcards.com/api/partner/v1/test-accounts \
--header 'Authorization: Bearer <token>'import requests
url = "https://catchbackcards.com/api/partner/v1/test-accounts"
headers = {"Authorization": "Bearer <token>"}
response = requests.post(url, headers=headers)
print(response.text)const options = {method: 'POST', headers: {Authorization: 'Bearer <token>'}};
fetch('https://catchbackcards.com/api/partner/v1/test-accounts', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://catchbackcards.com/api/partner/v1/test-accounts",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"net/http"
"io"
)
func main() {
url := "https://catchbackcards.com/api/partner/v1/test-accounts"
req, _ := http.NewRequest("POST", url, nil)
req.Header.Add("Authorization", "Bearer <token>")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://catchbackcards.com/api/partner/v1/test-accounts")
.header("Authorization", "Bearer <token>")
.asString();require 'uri'
require 'net/http'
url = URI("https://catchbackcards.com/api/partner/v1/test-accounts")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Bearer <token>'
response = http.request(request)
puts response.read_body{
"account": {
"user_id": "3b0e0000-…",
"email": "acme-9f2c41ab@test.catchbackcards.com",
"password": "x7Qe…",
"username": "swiftFalcon4821",
"balance": 10000,
"created_at": "2026-10-21T18:00:00Z",
"expires_at": "2026-11-20T18:00:00Z",
"active": true
},
"sign_in": {
"web": "https://catchbackcards.com/auth",
"note": "Sign in with email and password. The account is confirmed and phone-verified already."
}
}{
"error": "Missing or malformed API key"
}{
"error": "<string>",
"code": "<string>"
}{
"error": "<string>",
"code": "<string>"
}{
"error": "<string>",
"code": "<string>"
}{
"error": "<string>",
"code": "<string>"
}{
"error": "<string>",
"code": "<string>"
}Authorizations
Your API key, sent as a bearer token. Keep it on your server. See Authentication. A request from a location we refuse gets a 403 with Access denied, whether or not it has a valid key: where you can call from.