Add ordering to your own website

Authentication

Every request carries four headers. The signature proves the request came from you and hasn't been tampered with or replayed.

The string to sign

Five lines joined by a newline (\n):

UPPERCASE(METHOD)
PATH?QUERY                 ← exactly as sent
TIMESTAMP                  ← same as X-Rikaab-Timestamp
NONCE                      ← same as X-Rikaab-Nonce
hex(sha256(rawBody))       ← sha256 of "" for GET / no body

Signing, in Node.js

Any language works — HMAC-SHA256 with your secret. The Postman collection does this for you automatically.

const crypto = require('crypto');

// Sign a RIKAAB Partner API request with your website key.
function rikaabHeaders({ method, path, body = '', keyId, secret }) {
  const ts = Math.floor(Date.now() / 1000).toString();
  const nonce = crypto.randomBytes(16).toString('hex');
  const bodyHash = crypto.createHash('sha256').update(body).digest('hex');
  const stringToSign = [method.toUpperCase(), path, ts, nonce, bodyHash].join('\n');
  const signature = crypto.createHmac('sha256', secret)
    .update(stringToSign).digest('hex');
  return {
    'X-Rikaab-Key': keyId,
    'X-Rikaab-Timestamp': ts,
    'X-Rikaab-Nonce': nonce,
    'X-Rikaab-Signature': signature,
  };
}

// Example — fetch the menu
const rid = 'ten_xxxxxxxx';           // your restaurant id
const path = `/v1/partner/restaurants/${rid}/menu`;
const headers = rikaabHeaders({
  method: 'GET', path, keyId: 'pk_xxxx', secret: 'sk_xxxx',
});
const res = await fetch(`https://rikaab.in${path}`, { headers });
const menu = await res.json();

Diner-scoped calls (create / pay / track order) also sendX-Rikaab-Customer — the signed-in customer's token from the OTP verify step.