Developers

A plain API. Signed webhooks. No surprises.

Connect your till, your ERP or your app. The key names the store; its scopes say what it may do.

Create a test store Read the documentation

curl https://YOUR-KOMERXE-DOMAIN/api/v1/orders \
  -H "Authorization: Bearer kmx_your_key" \
  -H "Accept: application/json"

REST API v1

Products, orders, customers, inventory

One key per use: Keys start with kmx_, are shown once and stored hashed. Revoke one without touching the others.
Separate scopes: Read and write never come together by default. The accountant’s spreadsheet reads, your till writes.
No store in the URL: The key belongs to one store and can only reach its data.
Products: List, read, create and update your products and their stock.
Orders: List, read and mark an order as shipped, with carrier and tracking number.
Inventory: Read stock by location, record a count, move units.

Available scopes

products:read
products:write
orders:read
orders:write
customers:read
inventory:read
inventory:write

Webhooks

Told when it happens, with proof

Every delivery is signed with HMAC-SHA256 in the X-Komerxe-Signature header. If it fails, Komerxe retries after 1, 5 and then 30 minutes.

order.created
order.paid
order.fulfilled
order.cancelled
return.requested
product.updated

import { createHmac, timingSafeEqual } from 'node:crypto';

// Sign the raw body, as received, never re-serialised JSON.
export function isFromKomerxe(rawBody, signature, secret) {
  const expected = createHmac('sha256', secret).update(rawBody).digest('hex');

  return (
    signature.length === expected.length &&
    timingSafeEqual(Buffer.from(signature), Buffer.from(expected))
  );
}

Licensing API

Your software asks, Komerxe answers

A public API for publishers: your application checks its key without you hosting a licence server.

POST /api/licenses/verify: Does the key exist, is it valid, how many activations does it have left?
POST /api/licenses/activate: Attaches the key to a machine, within the activation limit you set.
POST /api/licenses/check: Your application’s heartbeat: is the key still valid on this machine?
POST /api/licenses/deactivate: Frees an activation when your customer changes machine.

Komerxe for software publishers

Create a store, generate a key, make your first call.

The free plan includes the API and webhooks.

Create my store for free See pricing