Developers

Nafaa API

Read products, stock, customers, sales and online orders from your Nafaa business, create customers, and get signed webhooks when something happens. REST over HTTPS with JSON, authenticated with an API key you create in Settings, Developer.

Updated 21 Oct 2026

Your first request

$ curl https://api.nafaa.pk/api/v1/me \
    -H "Authorization: Bearer nfk_your_key"

{
  "business": { "id": "…", "name": "Your business" },
  "shops": [{ "name": "Main branch", "isMain": true }],
  "key": { "scope": "read", "shopId": null },
  "apiVersion": 1
}

Authenticate
Create a key in Settings → Developer and send it as a bearer token.
Read your data
Products, stock, customers, sales and online orders, page by page.
Get webhooks
Signed events for sales, orders, customers and low stock.

The Nafaa API is a REST API at https://api.nafaa.pk/api/v1. Every request is authenticated with an API key from Settings → Developer in the Nafaa app, sent as a bearer token. Responses are JSON.

What you can do

Read products (by id, SKU or barcode), stock by branch, customers, sales and online orders.
Create a customer with a write key; the same phone number returns the existing customer.
Subscribe to webhooks such as sale.created or stock.low, which Zapier and Make can use as REST hooks.

Your first request

GET /v1/me tells you which business a key belongs to, so it is the quickest way to test a key.

Test your key

curlJavaScriptPython

curl "https://api.nafaa.pk/api/v1/me" \
  -H "Authorization: Bearer nfk_your_key"

const res = await fetch('https://api.nafaa.pk/api/v1/me', {
  headers: { Authorization: `Bearer ${process.env.NAFAA_API_KEY}` },
});
console.log(await res.json());

import os, requests

res = requests.get(
    'https://api.nafaa.pk/api/v1/me',
    headers={'Authorization': f"Bearer {os.environ['NAFAA_API_KEY']}"},
)
print(res.json())

Pagination

List endpoints take limit (1 to 100, default 50) and page (from 1), and return { data, page, limit, hasMore }. Keep asking for the next page while hasMore is true. Use updated_since (an ISO date) to fetch only what changed since your last sync.

Limits

Each key can make 120 requests a minute. A key can be limited to one branch; it then only sees that branch's data.

Endpoints

Method	Path	What it does
GET	`/v1/me`	The business the key belongs to
GET	`/v1/products`, `/v1/products/{id}`	Products; one by id, SKU or barcode
GET	`/v1/stock`	Stock by product and branch
GET	`/v1/customers`, `/v1/customers/{id}`	Customers
POST	`/v1/customers`	Create a customer (write key)
GET	`/v1/sales`, `/v1/sales/{id}`	Sales; one by id or sale number
GET	`/v1/orders`, `/v1/orders/{id}`	Online orders
GET, POST, DELETE	`/v1/webhooks…`	Webhook events and subscriptions

Explore the API

Authentication
Create an API key in Settings, Developer and send it as a bearer token on every request. Read keys can list data; write keys can also create customers. Keys can be limited to one branch and revoked at any time.
Products
GET /v1/products returns your products page by page, with search and updated_since filters. GET /v1/products/{id} finds a single product by its id, SKU or barcode, which is handy when a scanner or another system only knows the code.
Stock
GET /v1/stock returns the stock of every product in every branch, with its low-stock alert level and an isLow flag, so another system can mirror your stock or raise reorders. Filter by branch with shop_id and by change time with updated_since.
Customers
GET /v1/customers lists customers with search, phone and updated_since filters, and GET /v1/customers/{id} returns one. POST /v1/customers creates a customer with a write key; if the phone number already exists, the existing customer is returned instead of a duplicate.
Sales and online orders
GET /v1/sales lists counter and online sales, and GET /v1/orders lists online orders from your website, Shopify, WooCommerce, Daraz and other channels. Both take from, to, status and updated_since filters, and each has an endpoint to fetch one record by id.
Webhooks
Subscribe a URL to events such as sale.created, customer.created, online order updates and stock.low. Every delivery is signed with HMAC-SHA256 so you can verify it came from Nafaa, and a sample endpoint returns real example payloads for tools like Zapier.