API keys and your first call

An API key lets your own website or tools read your products, invoices and payments from Taji.

Create a key

1. In your admin, go to Settings, then API and webhooks.
2. Under API keys, choose Create a key.
3. Type a Name, such as “Accounting sync”.
4. Tick what the key Can do: Read products, Create orders, Read invoices or Read payments.
5. Type the Code from your authenticator app and choose Create the key.
6. Copy the key now. It is shown this once. After this only its last four characters.

Only the account owner can create keys. Keys can never refund, export or change staff.

Create orders opens no operation yet. A key can hold it, and it does nothing until then.

Make your first call

Send the key as a bearer token, to your storefront’s own address. The key works only on its own host. It is never accepted in a query string, a cookie or a body.

curl https://YOUR_STOREFRONT_ADDRESS/v1/api/products \
  -H "Authorization: Bearer YOUR_API_KEY"

A key looks like hf_live_ followed by 64 lowercase hex characters.

What you can read

Path	Scope	What it returns
GET /v1/api/products	Read products	Plans on sale, cheapest first, at the prices checkout charges. Optional cycle.
GET /v1/api/invoices	Read invoices	Invoices, newest first. Filter with status, customerId or updatedSince.
GET /v1/api/invoices/{invoiceId}	Read invoices	One invoice.
GET /v1/api/payments	Read payments	Confirmed and reversed payments, newest first. Filter with invoiceId, customerId or updatedSince.
GET /v1/api/payments/{paymentId}	Read payments	One payment.

Lists come in pages. Pass limit, and send the nextCursor from one answer as cursor to get the next page.

curl "https://YOUR_STOREFRONT_ADDRESS/v1/api/invoices?status=PAID&updatedSince=2026-11-01T00:00:00Z" \
  -H "Authorization: Bearer YOUR_API_KEY"

Money is always an object with amountMinor, a whole number of minor units, and currency. RWF has no minor unit, so {"amountMinor": 12000, "currency": "RWF"} is RWF 12,000.

Errors

Every error has a code and a message written for a person.

Status	Code	Meaning
401	API_KEY_INVALID	The key is missing, wrong, revoked or from another host.
403	SCOPE_MISSING	The key cannot do this. Create a key with the right scope.
429	RATE_LIMITED	Too many requests. Wait for the seconds in Retry-After.

Each key may make [API RATE LIMIT] requests a minute.

Revoke a key

Open the ⋯ menu on the key’s row and choose Revoke the key. It stops working at once and is never restored.

Lost a key? Revoke it and create another. A key cannot be shown again.

If something goes wrong

Contact Taji support at [email protected] or +250782009639.