Developer documentation

frequentix is API-first: the storefront, organiser console and scanner apps are all clients of the same platform API. This documentation covers the surface your systems can use — machine-to-machine OAuth clients, REST reads over your events and orders, and HMAC-signed webhooks for everything that happens in between.

At a glance

Everything here is verified against the platform: the field tables mirror the API’s serializers, and the worked signature example is recomputed by this site’s test suite on every build.

1 · Create an API client

In the organiser console, open Settings → Integrations and create a client. Pick the scopes it needs and whether it may see every event or only the ones you select. Creating and managing clients requires a multi-factor-verified session.

The client secret is shown once, at creation — store it in your secret manager straight away. There is no rotation endpoint: to rotate, create a replacement client and revoke the old one (revocation also invalidates its outstanding tokens).

2 · Mint a token

Exchange the client credentials for a bearer token. Note the token endpoint sits at the domain root — /oauth/token, not under /v1.

curl https://api.frequentix.com/oauth/token \
  -d grant_type=client_credentials \
  -d client_id=9e2c7a54-31d8-4a0b-9f3e-6b8d24c95a17 \
  -d client_secret=$FREQUENTIX_CLIENT_SECRET \
  -d "scope=events:read orders:read"

{
  "token_type": "Bearer",
  "expires_in": 31536000,
  "access_token": "eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiJ9…"
}

Cache the token and reuse it until expires_in lapses — don’t mint one per request. On a 401, mint a fresh token and retry once.

3 · Read your events

Every read is a plain GET with the bearer token. List responses are paginated — follow next_page_url until it’s null.

curl "https://api.frequentix.com/v1/integration/events" \
  -H "Authorization: Bearer $FREQUENTIX_TOKEN"

The API reference documents each endpoint’s fields with full example responses.

4 · Subscribe a webhook

In the console, open Delivery → Webhooks and add your endpoint URL, choosing which of the eleven event types to receive — for one event or across your whole organisation. The signing secret (whsec_…) is shown once when the subscription is created.

5 · Verify a signature

Every delivery is HMAC-signed so you can prove it came from frequentix:

X-Frequentix-Signature: t=1786730651,v1=722e85f919583b00ee5a48ee2f406a3f7ff7ca45978c26c44b5c0ccea4a5ad84

The webhooks guide walks through verification with ready-to-paste code for Node.js, PHP, Python and Ruby — including the raw-body caveat that catches most first attempts.

Building with an AI assistant? This documentation is mirrored as plain text at /developers/docs/llms.txt.