API & developer terms

1. These terms

These API & developer terms apply to anyone who uses the QwikStone API, registers on the developer site, creates an app, connects an app with QwikStone sign-in (OAuth), or receives webhooks (“you”). They are an agreement between you and Qwikstone Technologies Private Limited, together with the Terms of use and the Privacy policy. If you are a seller using the API for your own account, the Seller agreement also applies.

The API reference describes the endpoints, permissions (scopes), limits and webhook events; it forms part of these terms.

2. Access

• Seller API keys. A seller can create API keys in Seller Hub → Developer tools to connect their own systems (for example an ERP or stock sheet). Keys act with the full permissions of that seller account.
• Developer apps. Developers register for free, create apps and receive a client ID and secret. Sellers connect your app through QwikStone sign-in and choose which permissions to grant. Access tokens last one hour; refresh tokens last 90 days and can be revoked by the seller at any time.
• Plans. API access for a seller account requires a plan that includes it (International, Premium, Machinery Manufacturer or Brand membership). Calls for accounts without such a plan return an error.
• Test and live. New apps start in test status. We may review an app before it can be used by sellers outside your own organisation.

3. Licence

Subject to these terms, QwikStone gives you a limited, non-exclusive, non-transferable, revocable licence to use the API to build and run apps that help sellers use QwikStone. You may not sublicense the API, resell access to it, or use it for anything these terms don't allow. All rights not expressly granted remain with QwikStone.

4. Using sellers' data

• Use data you receive through the API only to provide your app's features to the seller who authorised it, within the permissions they granted.
• Don't sell, rent or share API data with third parties, combine one seller's data with another's to build profiles or benchmarks, or use it to contact buyers.
• Don't use API data to build or improve a competing marketplace, or to train AI models for anyone other than the authorising seller.
• Personal data of buyers, brokers or team members that reaches you must be protected with appropriate security, kept only as long as needed for the seller, and handled under the data-protection laws that apply. Where you process personal data for a seller, you do so on the seller's instructions.
• When a seller disconnects your app or deletes their account, stop using their data and delete it within 30 days, unless the law requires you to keep it.
• Your app must have a privacy policy that explains how it uses sellers' data, and must show the seller what it does before they connect it.

5. Security

• Keep API keys, client secrets, tokens and webhook signing secrets confidential. Never put them in client-side code, public repositories or URLs.
• Verify the QS-Signature header on every webhook before trusting it, and reject events with old timestamps.
• Use HTTPS for redirect addresses and webhook endpoints.
• Tell us at support@qwikstone.com within 72 hours if you suspect a key, secret or token has been exposed or data accessed without authorisation. We may revoke credentials to protect sellers.

6. Limits and fair use

Limits apply per seller account. Responses include headers showing your limit and what's left. Don't try to get around limits, for example with several keys or accounts. We may change limits with notice, and may temporarily slow traffic that harms the service.

7. What you must not do

• access the Services by any automated means other than the API, or call endpoints that aren't documented;
• interfere with, overload, probe or test the security of the API or the Services (report suspected vulnerabilities to support@qwikstone.com instead);
• create fake listings, orders, bids, reviews, clicks or accounts, or manipulate prices, rankings or ads;
• misrepresent your identity or your app, or suggest QwikStone endorses your app;
• use the API in breach of the law, these terms, or the rules that apply to sellers' listings and orders.

8. Fees

Registering as a developer and using the API is currently free; access for a seller account depends on the seller's plan. If we introduce fees for developers, we'll give at least 90 days' notice before they apply. You may charge sellers for your app, but you must make the price clear before they connect it.

9. Versions and changes

The API is versioned by date (for example 2026-10-01). We may add endpoints, fields and events at any time; build your app to ignore fields it doesn't recognise. We'll give at least 90 days' notice before we remove a version or make a change that breaks existing integrations, except where a change is needed urgently for security or legal reasons.

10. Branding

You may say your app “works with QwikStone” and use the QwikStone name to describe the integration accurately. Don't use the QwikStone logo or name in your app's name, logo or domain, or in a way that suggests QwikStone made or endorses your app, without our written permission.

11. Suspension and termination

You can stop using the API and delete your apps at any time. We may suspend or revoke keys, tokens or apps, with notice where reasonable, if you break these terms, your app puts sellers or their data at risk, or we are required to by law — immediately where needed to protect sellers. After termination, delete API data as described in section 4.

12. Disclaimers and liability

The API is provided “as is”. We work to keep it available and accurate but don't guarantee it will be uninterrupted or error-free. To the extent the law allows, QwikStone isn't liable for indirect or consequential losses arising from the API, and our total liability to you in connection with the API is limited to the fees you paid QwikStone for API access in the 12 months before the claim (or ₹10,000 if you paid none). You will compensate QwikStone for losses caused by your app or your breach of these terms.

13. Law and contact

These terms are governed by the laws of India, and disputes are resolved as set out in the Terms of use. Developer questions: developers@qwikstone.com. Grievance officer: [Grievance officer's name — to be added], grievance@qwikstone.com.