Embed the full AkibaMiles loyalty stack into your app or fintech product — quests, events, rewards, campaigns, vouchers, and webhook push — through a single REST API.
Authentication
Every partner gets a scoped API key (ak_live_*). Inbound webhooks from your backend are HMAC-SHA256 signed, timestamp-validated, and idempotency-keyed — replay-safe by design.
POST /api/v1/quests/:questId/verify
Authorization: Bearer ak_live_xxxxxxxxxxxxxxxxxxxx
Content-Type: application/json
{
"walletAddress": "0xabc…",
"idempotencyKey": "evt_2024_abc123",
"metadata": { "txHash": "0xdef…" }
}POST /webhooks/partners/:partnerSlug
X-Akiba-Partner-Key: <api-key-uuid>
X-Akiba-Signature: <HMAC-SHA256 hex>
X-Akiba-Timestamp: 1719600000
X-Akiba-Idempotency-Key: evt_unique_id_abc
// HMAC formula:
// HMAC-SHA256(webhookSecret, "${timestamp}.${rawBody}")API surface
Six capability groups. One auth model. Every endpoint returns structured JSON with consistent error codes.
Create executable, rewardable user actions. Define verification rules, reward rules, and lifecycle transitions (draft → active → paused → archived). Each completion writes to an immutable ledger.
POST /v1/questsPOST /v1/quests/:id/verifyGET /v1/quests/:id/analyticsPush arbitrary user events into the Akiba pipeline. Events fire quest triggers automatically — idempotent by SHA-256 hash of (eventType, questId, walletAddress, occurredAt).
POST /v1/eventsPOST /v1/events/batchGET /v1/events/summaryCreate raffle containers, attach quest gates for eligibility, check wallet eligibility, and manage campaign lifecycle. Entry is gated by quest completion — casual claimers excluded by design.
POST /v1/campaignsPUT /v1/campaigns/:id/quest-gatesGET /v1/campaigns/:id/eligibilityIssue, distribute, and claim Miles programmatically. Track balance per wallet, bulk distribute to a cohort, and confirm onchain claim transactions. All issuance is recorded on the immutable miles ledger.
POST /v1/rewards/issuePOST /v1/rewards/distribute/bulkGET /v1/rewards/balance/:walletReceive push notifications for quest verifications from your own backend. HMAC-SHA256 signed, timestamp-validated (±300 s), idempotency key required. Replay-safe by design.
POST /v1/webhooks/partners/:slugGET /v1/webhooksIssue voucher codes, manage a merchant catalog, and process redemptions. Full audit trail: every code issued and every redemption linked to a wallet and timestamp.
POST /v1/vouchers/issuePOST /v1/vouchers/:code/redeemGET /v1/catalog/:merchantSlugRate limits
Rate limits apply per API key. Violations return HTTP 429 with error code RATE_LIMIT_EXCEEDED. Talk to us if you need a custom limit.
60 req / min
Validate your integration and run a first campaign.
300 req / min
Production campaigns with real user volume.
1,000 req / min
High-throughput fintech integrations and platform embeds.
Who uses the API
Trigger mile issuance on qualifying M-Pesa or mobile-money transactions via event push or webhook. No SDK required — a single POST fires the reward pipeline.
Post a purchase event at checkout and have miles land in your customer's wallet before the receipt prints. Works with any stack — REST, not proprietary SDK.
White-label the full loyalty loop inside your own product. Quest completion, rewards, campaign eligibility — all callable from your backend, with your branding in the consumer-facing layer.
Get access
Tell us what you're building and we'll provision a partner key, walk you through the relevant endpoints, and get your first quest or event pipeline live within a day.
We respond within 2 business days with your key and onboarding notes.