Technical documentation for developers and integrations
API Authentication & Bearer Tokens Every partner API request is authenticated with a short-lived bearer token. You get the token by exchanging your OAuth client's ID and secret at the token endpoint. There are no long-li
2 Min. Lesezeit
API Error Handling & Standard Response Codes Errors from the partner API come in two forms. The OAuth token endpoint uses standard HTTP status codes. GraphQL endpoints usually return HTTP 200 and describe problems in an
2 Min. Lesezeit
API Rate Limits, Quotas & Best Practices To keep the platform responsive for everyone, the partner API limits how many requests can be made from one source in a time window. If you go over the limit, you get an HTTP 429
2 Min. Lesezeit
API Versioning Policy & Breaking Changes The partner API is versioned in the URL path. There's no version header. Within a version, the schema changes in ways that don't break existing queries. Removals are announced wit
1 Min. Lesezeit
Client Libraries & SDKs Kesk doesn't publish official SDKs for the partner API. Because the API is standard GraphQL over HTTPS, with standard OAuth 2.0 client credentials, any mainstream GraphQL and OAuth library works.
1 Min. Lesezeit
Developer API & Portal Overview Kesk's partner API lets your systems manage a store's catalogue, orders, locations, coupons and webhooks without anyone using the merchant portal. It's a GraphQL API, authenticated with OA
2 Min. Lesezeit
Managing API Keys & IP Address Whitelists Your integration's credentials are the client ID and secret of an OAuth client. This article covers how to manage them over their lifetime, and how IP address lists fit in. Creat
2 Min. Lesezeit
Merchant POS System Integration Guide If you already use a third-party point-of-sale or kitchen system, you can connect it to Kesk through the partner API. Kesk orders then arrive in your POS, status changes flow back to
1 Min. Lesezeit
OAuth2 Client Credentials & Scopes The partner and enterprise APIs use the OAuth 2.0 client credentials grant: your server authenticates as itself, with no user involved. Scopes decide what the resulting token can do. Th
2 Min. Lesezeit
SFTP Roster Files & Batch Data Transfers Kesk runs an SFTP server for enterprise customers. It's used to keep the company's employee roster in sync from an HR system, by dropping files instead of calling an API. Product
2 Min. Lesezeit
Testing Your Integration Safely Kesk doesn't publish a separate sandbox host for the partner API. Integrations are built against api.kesk.app. The practices below let you test without affecting real customers or real sto
1 Min. Lesezeit
Using the GraphQL Schema & Subscriptions Each vertical of the partner API has its own GraphQL schema, fitted to what that kind of business does. A food schema has menus and reservations, and a parcel schema doesn't. The
1 Min. Lesezeit
Verifying Webhook HMAC SHA-256 Signatures Every webhook delivery from Kesk is signed, so you can prove it came from Kesk and wasn't changed on the way. Reject any request whose signature doesn't match. How the signature
1 Min. Lesezeit
Webhooks & Real-Time Event Subscriptions Webhooks push events to your server as they happen, so you don't have to poll for new orders or status changes. You register an HTTPS endpoint, choose the events you want, and Kes
2 Min. Lesezeit
Brauchen Sie noch Hilfe?