Changelog

2026-09 — v1Copy Anchor Link

The first version of Kivoo’s public API.

API keys

• Keys per store, prefixed kv_live_, shown once, with an optional expiry and at most ten active keys per store.
• Scopes per resource: Store and Orders read-only, Products, Customers and Payment links read and write.
• A rate limit of 120 requests per minute and per key.

Public API (https://api.kivoo.africa/v1)

• Store: GET /v1/store.
• Products: list, read, update and publish (GET /v1/products, GET /v1/products/{id}, PATCH /v1/products/{id}).
• Orders: list and read (GET /v1/orders, GET /v1/orders/{id}).
• Customers: list, read, create, update (GET and POST /v1/customers, GET and PATCH /v1/customers/{id}).
• Payment links: list, read, create, update, pause and resume (/v1/payment-links).

Webhooks

• Up to five HTTPS webhooks per store and six webhook events: order.paid, order.failed, customer.created, product.published, product.archived, payment_link.paid, plus ping for tests.
• A Kivoo-Signature signature (HMAC-SHA256) and a stable event id for idempotency.
• Eight attempts over a little more than twenty-two hours, a thirty-day delivery journal, manual resend and automatic disabling after three days of failures.