Available immediately. Synthetic resources only. Keys begin with klx_test_. Webhook payloads have livemode: false.
Build safely against ecommerce operations.
The developer API begins in test mode with synthetic resources. Production access is explicit, tenant-authorized, and review gated.
Quickstart
- Create an app in the developer portal.
- Copy the reveal-once test key.
- Call the sandbox resource endpoint.
- Add an HTTPS webhook endpoint and send a signed test.
curl https://api.klaxify.com/api/developer/v1/sandbox/resources \ -H "Authorization: Bearer klx_test_..."
Authentication
Send the raw key as an HTTP Bearer credential. Keys are shown once; klaxify stores only their SHA-256 hash. Rotate by creating a replacement and revoking the old key.
Authorization: Bearer klx_test_...
Never put keys in browser code.
Use them from your server, secret manager, CI environment, or backend function.
Environments
Available after app review. Keys begin with klx_live_. Installations require explicit tenant authorization and approved scopes.
Resources
Read the available integration capability catalog, then test against a coherent synthetic customer, order, and conversation graph. Sandbox resources can be filtered by type.
GET /api/developer/v1/integrations GET /api/developer/v1/sandbox/resources GET /api/developer/v1/sandbox/resources?resource_type=order
Events and idempotency
Use a stable external_id when retrying. Reusing it returns the original event rather than creating a duplicate.
POST /api/developer/v1/sandbox/events
{
"type": "order.updated",
"external_id": "your-event-1001",
"data": {"order_number": "#1001"}
}Verify webhooks
klaxify signs the exact request bytes. Parse the timestamp and v1 digest from X-Klaxify-Signature, reject timestamps older than five minutes, compute HMAC-SHA256 over {timestamp}.{raw_body}, and compare digests in constant time.
X-Klaxify-Signature: t=1785067200,v1=abc123... X-Klaxify-Event: order.updated X-Klaxify-Delivery: evt_...
Return any 2xx response within eight seconds. Non-2xx and network errors enter a bounded retry schedule and remain visible in the portal.
Production review
Public apps must provide a support address, privacy policy, terms, least-privilege scopes, secure redirect URLs, a verified webhook endpoint, idempotent processing, and clear customer-data lifecycle behavior.
- Secrets never stored in source control
- Tenant data never mixed across installations
- Retries and duplicate events handled safely
- Customer data deletion and retention documented
- Commerce actions declare validation and approval behavior