Connect legacy tools through the Native Compatibility API or build new server-side integrations with Secure B2B V1. Both modes use the same protected billing, provider selection and recovery engine.
POST /login/api/api_sell.phpPOST /login/api/v1/sell.phpFRP + FDLProtected billing
Integration profiles
Choose the correct API
Use one mode per client. Do not mix authentication fields from both profiles.
Legacy tool compatible
Native Compatibility API
For existing tools already designed to send a panel username, panel password, soc and configblob.
JSON or form-urlencoded
Always parses success
Authorization returned in data.response
Automatic duplicate-charge protection
Advanced server integration
Secure B2B API V1
For new server-side integrations using a one-time issued Bearer credential and an explicit idempotency key.
JSON only
Bearer authentication
IP allowlist support
Explicit safe retries
Legacy tools
Native Compatibility API
Use the customer's own panel username and password. Telegram, database and upstream-provider credentials are never used here.
Safe retry: resend the identical JSON with the same Idempotency-Key after a lost response or recovery_pending. Never create another key for that same device operation.
Service data
Build the correct configblob
FRP and FDL use Base64, but their source data is intentionally different.
FRP source
Create the complete device JSON first, then Base64-encode that entire JSON.
Timeout: use a client read timeout of at least 150 seconds. Native Compatibility automatically derives duplicate protection from the customer and device payload. V1 clients must preserve their original body and Idempotency-Key for retries.
JSON schema
Responses
Both modes use success and return authorization only in data.response.
The API generates authorization; the client tool remains responsible for device communication.
01
Read device data
Obtain the real model/codename and device token using the tool's established Fastboot protocol.
02
Request authorization
Build the correct Base64 payload, send one POST operation and require success: true.
03
Write and reboot
Pass only data.response to the tool's existing write routine. Reboot with fastboot reboot only after confirmed write success.
Do not guess a write command: Xiaomi authorization commands vary by protocol. Never substitute an arbitrary fastboot flash or fastboot oem instruction.
Failure handling
Error matrix
Native mode uses top-level error_code; V1 uses error.code. Messages are for people, not program logic.
HTTP
Error code
Meaning
Required action
400
invalid_idempotency_key
Operation key is missing or malformed.
Create a valid 16–80 character key before the first attempt.
401
invalid_api_key
Credential is invalid, incomplete or rotated.
Stop and request a credential rotation.
402
insufficient_credit
The account balance is lower than the service price.
Add credit and retry with the same operation data.
403
account_disabled
The API client or user account is disabled.
Contact the account administrator.
403
ip_not_allowed
The request source is outside the configured allowlist.
Add the correct fixed public IP.
403
service_not_allowed
FRP or FDL is not enabled for this client.
Request service permission.
409
request_in_progress
The same operation is currently processing.
Wait briefly, then resend identical JSON with the same key.
409
idempotency_conflict
The key was reused with different data.
Do not retry until the integration bug is corrected.
422
invalid_configblob
The Base64 payload does not match the service contract.
Correct the payload before retrying.
422
provider_rejected
The provider rejected the operation.
No Click credit was charged. Verify device data.
429
rate_limit_exceeded
The client exceeded its per-minute request limit.
Wait for the Retry-After value.
502
upstream_unavailable
The provider failed before returning valid authorization.
No Click credit was charged. Retry according to support guidance.
503
recovery_pending
Authorization is protected and settlement is pending.
Retry identical JSON with the same key.
503
provider_status_unknown
The upstream result is ambiguous.
Do not create another operation. Contact support with request_id.
503
maintenance
The B2B gateway is temporarily disabled.
Wait and retry later.
Production rules
Security practices
Integrations are safest when secrets stay server-side and operational data is deliberately minimized.
A
Protect credentials
Store credentials in an environment variable or protected server configuration. Rotate immediately after suspected exposure.
B
Redact logs
Never log the Authorization header, configblob, raw device token or returned authorization response.
C
Validate every response
Check both the HTTP status and JSON success value. Keep the request ID for safe support investigation.