Stable route prefix
All current endpoints live under /api/v1. Breaking changes will use a new version prefix instead of silently changing v1 behavior.
API governance
Versioning and stability policy
The Nakroteck Client API is versioned under /api/v1. V1 is designed for first-party client apps and integrations.
Invoice-first billing
Orders create Nakroteck invoices. Payment completion and provisioning still run through the existing invoice lifecycle and webhooks.
Bearer token auth
Use Sanctum bearer tokens. Revoke tokens from the client area when a device, app, or integration is no longer trusted.
Client context
Protected client endpoints use the route client ID and may also receive X-Client-Id. If both are present, they must match.
Idempotency
Order creation and native payment-start endpoints require Idempotency-Key so retries do not create duplicate orders or payment sessions.
Payment status polling
API clients should poll the invoice payment-status endpoint after starting Stripe or Paystack payment. Webhooks remain the source of truth for completion.
Deprecation policy
Non-breaking additions may ship anytime. Deprecated fields will remain for a practical migration window before removal in a future version.