The KhajaGo Partner API

Live in three steps

From zero to your first authenticated request and real-time events.

curl https://api.khajago.com/api/public/v1/me \
  -H "Authorization: Bearer ksk_live_xxx"

Authentication

Create an API key from your Restaurant dashboard → Developer settings. Each key is scoped to a single restaurant and shown only once — store it securely, server-side. Send it as a Bearer token or an x-api-key header.

Scopes

Assign only what each integration needs. Keys missing a scope are rejected with 403.

Endpoints

curl "https://api.khajago.com/api/public/v1/orders?status=placed&limit=20" \
  -H "Authorization: Bearer ksk_live_xxx"

curl -X PATCH https://api.khajago.com/api/public/v1/orders/ORDER_ID/status \
  -H "Authorization: Bearer ksk_live_xxx" \
  -H "Content-Type: application/json" \
  -d '{"status":"accepted"}'

Real-time events

import crypto from "crypto";

export function verify(req, secret) {
  const sig = req.headers["x-khajago-signature"];
  const expected =
    "sha256=" +
    crypto.createHmac("sha256", secret)
      .update(JSON.stringify(req.body))
      .digest("hex");
  return crypto.timingSafeEqual(
    Buffer.from(sig), Buffer.from(expected)
  );
}

Conventions

Predictable, REST-style responses. Every payload is JSON with a top-level status boolean, so success and failure are trivial to branch on.

// 403 — missing scope
{
  "status": false,
  "message": "This API key is missing the
             required scope: orders:write"
}