Is the API included or an add-on?
It is how the product works rather than a feature bolted on top, so API access comes with the platform. Your own development time is the cost, not an API licence.
Integrations
A REST API covering everything the apps can do
Gaffer is API-first by construction — the web app and the mobile app are both clients of the same REST API, so there is no operation available in the product that is unavailable to you. Around 1,274 endpoints under /api/v1, with bearer token auth and outbound webhooks for events.
No credit card required · One platform · Web & Android (iOS coming soon)
How the Gaffer API works
The same API the product runs on, documented and available to your own systems.
API-first, not API-also
The React web app and the Expo mobile app are both clients of this API. That means no business logic hides in a web-only path, and anything the product does is reachable programmatically.
Token auth with refresh
Bearer access tokens with refresh tokens, so integrations hold long-lived access without storing credentials.
Events pushed out
Outbound webhooks with a signed payload and delivery retry push events into your systems, so you are not polling for changes.
What you get
The API sits alongside outbound webhooks, the Zapier connection and the integration marketplace.
- Around 1,274 REST endpoints under /api/v1
- The same API that powers the web and mobile apps
- Bearer access tokens with refresh token support
- Every request scoped to your business
- Outbound webhooks with HMAC-signed payloads
- Webhook delivery retry with a dead-letter view
- OpenAPI specification and endpoint documentation available
Common questions about developer api
How does authentication work?
Bearer tokens sent in the Authorization header, with short-lived access tokens and longer-lived refresh tokens. It is the same scheme the mobile app uses, so it is well exercised rather than a secondary path.
How do I get notified of changes?
Outbound webhooks push events to your endpoint with an HMAC signature you can verify. Deliveries are retried on failure and failures land in a dead-letter view, so a broken endpoint is visible rather than silently dropping events.
What if I do not have a developer?
Then use the Zapier connection instead — it reaches thousands of applications with no code. The API is there for the cases where an off-the-shelf connection genuinely will not do.
Build on the platform
14 days free. Full access. No card needed.