Build on
DealsGoKart.

Authenticating

Every request must include a JWT — obtain it via POST /api/auth/login. The token comes back as both an HttpOnly cookie (set automatically by the browser) and as a Bearer string you can use server-to-server.

# 1. Get a token
curl -X POST https://dealsgokart.com/api/auth/login \
     -H "Content-Type: application/json" \
     -d '{"email":"you@yourcompany.in","password":"…"}' \
| jq -r .token

# 2. Use it
curl https://dealsgokart.com/api/products?limit=20 \
     -H "Authorization: Bearer $TOKEN"

Per-IP rate limits apply — see the X-RateLimit-Limit / -Remaining /-Bucket response headers. Auth endpoints are limited more strictly than read endpoints.

Subscribing to events

Register a webhook from the admin console (/admin → Webhooks) or via the API. We POST every matching event as a JSON body with an HMAC signature you should always verify before acting on it.

POST /your-webhook HTTP/1.1
Content-Type: application/json
X-DGK-Event: order.created
X-DGK-Event-Id: evt_8a9f3...
X-DGK-Signature: sha256=37c4...e91
X-DGK-Delivery: 9c2f47...

{
  "id": "evt_8a9f3...",
  "type": "order.created",
  "payload": {
    "order_id": "ord_a1b2c3",
    "order_number": "DGK-20260201-0042",
    "buyer_id": "u_buy_xxx",
    "supplier_ids": [
      "u_sup_yyy"
    ],
    "total": 12450,
    "channel": "b2b",
    "item_count": 3
  },
  "created_at": "2026-02-01T10:24:31.000Z"
}

import crypto from "crypto";

export function verifyDgkSignature(rawBody, signatureHeader, secret) {
  // signatureHeader looks like "sha256=37c4...e91"
  const expected = "sha256=" + crypto
    .createHmac("sha256", secret)
    .update(rawBody)
    .digest("hex");
  // Constant-time compare to defeat timing attacks.
  return crypto.timingSafeEqual(
    Buffer.from(signatureHeader),
    Buffer.from(expected),
  );
}

import hmac, hashlib

def verify_dgk_signature(raw_body: bytes, signature_header: str, secret: str) -> bool:
    expected = "sha256=" + hmac.new(
        secret.encode(), raw_body, hashlib.sha256
    ).hexdigest()
    return hmac.compare_digest(signature_header, expected)

We retry failed deliveries 3 times with exponential backoff (30s → 5m → 30m). Inspect the live delivery log at GET /api/admin/webhooks/{id}/deliveries.

Three things you can build this afternoon