API Docs — Tekovate Public API

Getting started

Four steps — one minute.

Create an API key

In the admin console, open Settings → API Keys and click New key. Copy the key immediately — you won't see it again.

Store it as a secret

Put the key in your environment (e.g. TEKOVATE_API_KEY), not in source code or client-side JavaScript. API keys grant tenant-wide read access.

Send your first request

Every call goes to the same base URL and carries the key in the X-API-Key header. Pick your language below.

Handle errors and rate limits

Expect 401 for bad keys, 404 for missing resources, and 429 when you exceed your per-minute quota (default 60/min). Always retry 429/5xx with exponential backoff.

Code examples

Fetch the last 10 completed orders:

curl "https://akwfiwpnjneylmeaiulk.supabase.co/functions/v1/public-api/orders?status=completed&limit=10" \
  -H "X-API-Key: pk_live_YOUR_KEY_HERE"

const res = await fetch(
  "https://akwfiwpnjneylmeaiulk.supabase.co/functions/v1/public-api/orders?status=completed&limit=10",
  { headers: { "X-API-Key": process.env.TEKOVATE_API_KEY } }
);
const { data: orders } = await res.json();
console.log(orders);

import os, requests

r = requests.get(
    "https://akwfiwpnjneylmeaiulk.supabase.co/functions/v1/public-api/orders",
    headers={"X-API-Key": os.environ["TEKOVATE_API_KEY"]},
    params={"status": "completed", "limit": 10},
)
r.raise_for_status()
orders = r.json()["data"]
print(orders)

Response:

{
  "data": [
    {
      "id": "a3bf1e2c-5d7e-4f01-b2a8-0e9c4f5b1d3a",
      "order_no": "ORD-000123",
      "customer_id": "d1e2f3a4-5b6c-7d8e-9f01-2a3b4c5d6e7f",
      "status": "completed",
      "payment_status": "paid",
      "fulfillment_status": "fulfilled",
      "grand_total": "2420.0000",
      "currency_code": "CZK",
      "created_at": "2026-04-16T08:12:43.521Z"
    }
  ]
}

Authentication & rate limits

X-API-Key header

Send your key as X-API-Key: pk_live_... on every request. Keys are tenant-scoped; responses only include rows owned by that tenant.

Rate limits

Default 60 requests/minute per key (configurable). Exceeding returns HTTP 429 — back off and retry.

Revocation

Revoke a key anytime from Settings → API Keys. Revoked keys return 401 Key revoked immediately.

Security

Never expose keys in browser JavaScript. They grant read access to all data for the tenant. Use a backend proxy if you need browser access.

Error reference

All error responses share the shape { error: string }.

Status	When	Retry?
`200`	Success.	—
`401`	Missing, invalid, revoked, or expired API key.	No — fix the key.
`404`	Resource not found, or doesn't belong to your tenant.	No.
`429`	Rate limit exceeded for this key.	Yes — exponential backoff.
`500`	Internal server error.	Yes — exponential backoff.

Tekovate Public API