Rappi Authentication: API Access and Security (2026)

Authentication overview

Rappi's API authentication mechanisms are designed to secure interactions between partner systems and the Rappi platform. As a comprehensive on-demand delivery and logistics service, Rappi processes sensitive order, catalog, and customer data. Consequently, robust authentication is a prerequisite for all API consumers, ensuring that only authorized entities can access and manipulate resources.

The Rappi API primarily supports integrations for merchants and logistics partners, enabling functionalities such as order creation, modification, status tracking, and catalog synchronization. Access to the API and its authentication credentials is typically granted following a formal partnership agreement with Rappi. This process ensures that integrations align with Rappi's operational and security standards, supporting the secure exchange of information for food delivery, grocery delivery, and other e-commerce services.

Developers integrating with Rappi should familiarize themselves with the specific authentication flows outlined in the official Rappi API documentation to ensure secure and compliant communication. Adherence to these protocols is essential for maintaining data integrity and protecting user privacy, in line with regulations such as GDPR compliance standards.

Supported authentication methods

Rappi's API employs a combination of authentication methods to secure its endpoints, primarily relying on API keys and signature-based authentication. These methods are common in B2B API integrations where server-to-server communication is prevalent.

API Keys: API keys serve as a unique identifier and secret token for an application or user. When making a request, the API key is typically included in the request headers or as a query parameter. Rappi's system validates this key against its records to determine if the request originates from an authorized partner. API keys are relatively straightforward to implement and manage for many common integration scenarios.

Signature-Based Authentication: For enhanced security, particularly for critical operations or sensitive data exchanges, Rappi also utilizes signature-based authentication. This method involves generating a unique signature for each request, often by hashing the request's content (body, headers, timestamp) with a shared secret key. The generated signature is then sent along with the request. The Rappi server performs the same signature generation process on its end and compares it with the received signature. A match confirms the request's authenticity and integrity, ensuring that the request has not been tampered with in transit and originates from a legitimate source. This method helps mitigate risks like replay attacks and unauthorized request modification, as detailed in general webhook security best practices.

The choice of authentication method depends on the specific API endpoint and the nature of the operation being performed. Developers should consult the Rappi API documentation's introduction for precise requirements for each API call.

Authentication Method Comparison

Getting your credentials

Accessing Rappi's API and obtaining the necessary authentication credentials, such as API keys and shared secrets for signature generation, is part of a structured onboarding process for partners. Rappi's developer experience notes indicate that API access typically requires a partnership agreement, distinguishing it from public APIs that offer immediate self-service access.

The general steps to acquire your Rappi API credentials involve:

1. Initiate a Partnership: Contact Rappi's business development or partner relations team to discuss your integration needs. This initial engagement will determine if your business model aligns with Rappi's partnership programs, such as merchant integration for order fulfillment or logistics collaboration.
2. Agreement and Onboarding: Upon successful negotiation, a formal partnership agreement will be established. Following this, Rappi's technical onboarding team will guide you through the process of setting up your developer account and providing access to the API portal or relevant documentation.
3. Credential Generation: Within the partner portal or through direct communication with Rappi's support, you will be able to generate or be provided with your unique API keys and any shared secrets required for signature-based authentication. These credentials are confidential and must be handled with extreme care.
4. Environment Setup: Rappi may provide separate credentials for sandbox (testing) and production environments. It is crucial to use the appropriate credentials for each environment during development and deployment.

For detailed, step-by-step instructions on credential generation specific to your partnership type, refer directly to the Rappi API documentation provided during your onboarding.

Authenticated request example

While specific code examples for Rappi's API often depend on the exact endpoint and authentication method (API key vs. signature-based), a common pattern for including an API key is through HTTP headers. For signature-based requests, the complexity increases as it involves cryptographic operations on the request payload.

Below is a conceptual example of an authenticated request using an API key, assuming it's passed via an X-API-Key header. This is a simplified representation; actual Rappi API calls will have specific endpoints, request bodies, and potentially additional headers.

curl -X GET \
  'https://api.rappi.com/v1/orders/status?orderId=12345' \
  -H 'Content-Type: application/json' \
  -H 'X-API-Key: YOUR_RAPPI_API_KEY'

For signature-based authentication, the process involves:

1. Constructing the Canonical Request: This typically includes the HTTP method, path, query parameters, headers (e.g., Content-Type, Date or X-Rappi-Date), and the request body.
2. Hashing the Canonical Request: A cryptographic hash function (e.g., SHA256) is applied to the canonical request string.
3. Signing the Hashed Request: The hashed request is then signed using a shared secret key and a signing algorithm (e.g., HMAC-SHA256).
4. Adding Signature to Headers: The resulting signature, along with other parameters like the key ID and signing algorithm, is included in a specific HTTP header (e.g., Authorization or X-Rappi-Signature).

Because signature generation is complex and highly specific to Rappi's implementation, developers should refer to the official Rappi API documentation for precise algorithms, header names, and example code in various programming languages. This documentation will provide the most accurate and up-to-date guidance for generating valid signed requests.

Security best practices

Securing your integration with Rappi's API is crucial for protecting sensitive data, maintaining operational integrity, and ensuring compliance. Adhering to established security best practices can significantly mitigate risks.

• Protect Your Credentials: Treat your API keys and shared secrets as highly sensitive information. Never hardcode them directly into your application's source code. Instead, use environment variables, secure configuration files, or a secrets management service (e.g., AWS Secrets Manager, Google Secret Manager, Azure Key Vault). Restrict access to these credentials to authorized personnel only.
• Use HTTPS/TLS: Always ensure that all communication with Rappi's API occurs over HTTPS (HTTP Secure). This encrypts data in transit, protecting it from eavesdropping and man-in-the-middle attacks. Rappi's API endpoints are designed to enforce TLS encryption, but it's essential to confirm your client-side implementation properly validates SSL/TLS certificates.
• Implement Least Privilege: Configure your API access with the principle of least privilege. Request and use only the permissions necessary for your application's functionality. If Rappi's API supports granular permissions, apply them to limit the scope of what your API key can do.
• Rotate Credentials Regularly: Periodically rotate your API keys and shared secrets. This practice minimizes the window of exposure if a credential is compromised. Rappi's partner portal or support channels should provide mechanisms for credential rotation.
• Log and Monitor API Activity: Implement comprehensive logging for all API requests and responses. Monitor these logs for unusual patterns, failed authentication attempts, or unexpected API usage, which could indicate a security incident. Set up alerts for suspicious activities.
• Validate and Sanitize Input: Always validate and sanitize all data sent to the Rappi API. This prevents injection attacks and ensures that your application is sending well-formed, expected data, reducing the risk of errors or malicious manipulation.
• Handle Errors Securely: Ensure that your application handles API errors gracefully and securely. Avoid exposing sensitive information in error messages to end-users or logs that are publicly accessible.
• Secure Your Development Environment: Extend security best practices to your local development and staging environments. Ensure that non-production credentials are not used in production and that test data is properly isolated and secured. Developers should follow general web security guidelines to prevent common vulnerabilities in their applications.