They published an API and hid the door

Verification date: October 2026. Re-verified for this draft: robots.txt, the anonymous OpenAPI spec, and the marketing homepage.

Labels used throughout

• [FACT] — checkable against the primary source linked in the Receipts section. Where the only evidence is our own observation rather than a published document, it says so.
• [OPINION] — the author’s view. Argued on top of the facts, never instead of them.
• [UNVERIFIED] — could not be confirmed. Kept in the text only where the uncertainty matters.

One thing this piece does not do: it contains no instructions for scraping, evading rate limits, bypassing robots.txt, or violating any provider’s terms. Reading a public robots.txt and fetching a public spec is not a bypass. “The portal is hard to find” is the story. “Here is how to abuse it” is not.

I could not find the door, so I checked whether it existed

I run a small self-hosted storefront for a family apparel brand. No Shopify, no app stack, one Linux box and an order desk I wrote myself. That means I need a print-on-demand supplier with a real server-to-server API, and I picked Tapstitch for the fulfilment leg after comparing several.

Integrating it was not the hard part. Finding it was. [FACT] Their signup flow offers six store connectors (Shopify, Etsy, WooCommerce, Wix, Squarespace, BigCommerce), and the headless API is not one of the paths offered. On the marketing homepage as fetched (730 KB, HTTP 200), those six are the integrations named, the word “developer” appears zero times, and no link points at the developer portal. That last part is machine-checkable; the signup walkthrough is my own experience of their account flow, which a reader can reproduce in five minutes by making an account.

[FACT] Nothing on the homepage offers a human a route to the API. Its only “API” strings are internal front-end build variables inside the page source. There is no user-facing link.