API Overview

🏗️ Architecture Foundation: Understanding the Okinus API structure will help you build robust integrations and handle edge cases gracefully.

API Architecture

The Okinus API consists of two main components that work together:

🔄 Typical Flow:

Your Server → REST API → Create Checkout → JavaScript Library → Customer Interaction → Webhooks → Your Server

Environments & Authentication

Environment Configuration

Authentication Methods

🔐 Server-to-Server (REST API):

Authorization: Bearer YOUR_API_TOKEN
Content-Type: application/json
Accept: application/json

🌐 Frontend (JavaScript Library):

const okinus = Okinus({
    baseUri: "https://beta2.okinus.com/",
    retailerSlug: "YOUR_RETAILER_SLUG",
    storeSlug: "YOUR_STORE_SLUG"
});

Key Functional Areas

1. Customer Applications

• Credit Applications: Pre-qualification without purchase
• Identity Verification: Secure customer validation
• Approval Processing: Real-time decision engine

2. Checkout Processing

• Create Sessions: Generate secure checkout URLs
• Monitor Progress: Track customer through the flow
• Handle Completion: Process successful transactions

3. Contract & Payment

• E-Signature: Digital contract signing
• Down Payments: Secure payment processing
• Payment Terms: Flexible lease options

4. Order Fulfillment

• Delivery Authorization: Approve product delivery
• Status Updates: Track order progress
• Funding Confirmation: Merchant payment status

5. Real-time Notifications

• Webhooks: Instant status updates
• Event Tracking: Complete audit trail
• Error Handling: Automatic retry logic

Security Best Practices

1. API Token Security:
   • Store tokens securely (environment variables)
   • Never expose tokens in client-side code
   • Rotate tokens regularly
2. Webhook Validation:
   • Always validate webhook signatures
   • Use HTTPS endpoints only
   • Implement idempotency checks
3. Data Handling:
   • Encrypt sensitive customer data
   • Follow PCI compliance guidelines
   • Log security events

⚠️ Common Security Mistakes:

• ❌ Hardcoding API tokens in source code
• ❌ Using HTTP instead of HTTPS
• ❌ Not validating webhook signatures
• ❌ Storing sensitive data in logs