Developer API

Updated on 13 November 2026

Download as PDF

The Replivo API connects the chat to your own back office or CRM: receive visitor messages as they are written and reply from your own software. The reply appears to the visitor in the chat window, exactly as if sent from the panel.

How it works

1. Create an API key under Settings → API and integrations.
2. Set your webhook address: Replivo sends every new visitor message there.
3. Reply by calling the API with your key.
4. Send the presence signal regularly so the widget shows you as online.

Authentication

Every request carries the key in the Authorization header. The key is a secret: use it only from your server, never from code in a web page. A revoked key stops working within a minute.

Authorization: Bearer rpl_…

Base URL: https://developer.replivochat.com/api/v1

Responses are JSON: data under the data field, errors under error with a code and a message.

curl https://developer.replivochat.com/api/v1/me \
  -H "Authorization: Bearer rpl_…"

Endpoints

Example: reply to a visitor

curl -X POST https://developer.replivochat.com/api/v1/conversations/CONVERSATION_ID/messages \
  -H "Authorization: Bearer rpl_…" \
  -H "Content-Type: application/json" \
  -d '{"text": "Po, e kemi në stok.", "agentName": "Arta"}'

Sending a file (content encoded as base64)

curl -X POST https://developer.replivochat.com/api/v1/conversations/CONVERSATION_ID/files \
  -H "Authorization: Bearer rpl_…" \
  -H "Content-Type: application/json" \
  -d '{"name": "oferta.pdf", "contentType": "application/pdf", "dataBase64": "JVBERi0xLjQK…"}'

Presence

The widget shows “Online” only when someone can answer. If you reply only from your own system, call this regularly (for example every minute) while your operators are at work. When the signal stops, the widget switches to the message form by itself once the time runs out.

curl -X PUT https://developer.replivochat.com/api/v1/presence \
  -H "Authorization: Bearer rpl_…" \
  -H "Content-Type: application/json" \
  -d '{"online": true, "ttlSeconds": 120}'

Webhooks

Set the address under Settings → Business → Webhook URL. It must be https. Replivo sends a POST request for each event:

Example body for message.created

{
  "id": "0b1f…",
  "event": "message.created",
  "workspaceId": "…",
  "createdAt": "2026-11-13T17:40:00.000Z",
  "data": {
    "conversationId": "…",
    "messageId": "…",
    "siteId": "…",
    "from": "visitor",
    "text": "A e keni produktin në stok?",
    "attachments": [],
    "visitor": { "id": "…", "name": "Besa", "email": "besa@example.com" },
    "createdAt": "2026-11-13T17:40:00.000Z"
  }
}

Verifying the signature

Create a signing secret under Settings → API and integrations. Every request then carries the X-Replivo-Signature header with the time t and the signature v1 = HMAC-SHA256 of the string “t.body” with your secret. Reject requests with a wrong signature or a time older than five minutes.

// Node.js (Express): use the raw request body, not the parsed JSON
const crypto = require("crypto");

function verify(rawBody, header, secret) {
  const parts = Object.fromEntries(header.split(",").map((p) => p.split("=")));
  if (Math.abs(Date.now() / 1000 - Number(parts.t)) > 300) return false;
  const expected = crypto.createHmac("sha256", secret).update(parts.t + "." + rawBody).digest("hex");
  return expected.length === parts.v1.length &&
    crypto.timingSafeEqual(Buffer.from(expected), Buffer.from(parts.v1));
}

Good to know

• Every notification is sent immediately. Answer within 5 seconds with a 2xx code; otherwise it is retried after 1 minute, 5 minutes, 30 minutes, 2 hours and 12 hours, then marked failed.
• The id field is the same on every retry: use it to avoid processing the same event twice.
• The delivery log is shown under Settings and at /webhooks/deliveries, and is kept for about 7 days.
• The limit is about 240 requests per minute per key. Beyond it you get 429.
• Replying to a closed conversation returns 409: reopen it first.
• The first reply from the API takes the conversation, as in the panel.

Error codes

For technical questions write to info@replivochat.com.