REST APIs
Clear resources, consistent errors, pagination and versioning, with an OpenAPI file other developers can import into Postman or a code generator.
API Development in Nepal
I’m Ujjwal Rupakheti, a full-stack developer in Itahari offering API development in Nepal. I design and build REST APIs, webhooks and integrations with payment gateways like eSewa, Khalti and Fonepay, plus SMS, email and AI models, documented in OpenAPI so other developers can use them without calling me.
- I built the public API for Eknas, documented in OpenAPI 3.1
- Payments confirmed on the server and recorded once
- The contract agreed in writing before the code
Sample: the same bill, sent twice
POST /v1/bills Authorization: Bearer sk_live_•••• Idempotency-Key: 7f3c9e21-a91e { "phone": "98•••••412", "amount_npr": 1250 } 201 Created { "id": "bill_8KQ2", "points": 1250 }
network drops, the till retries
200 OK { "id": "bill_8KQ2", "points": 1250, "duplicate": true } # same key, same result: points added once
01What’s included
What Does API Development Include?
API development is designing and building the endpoints that let your app, your partners’ systems and your mobile clients read and change data safely. It covers the contract, sign-in and keys, validation, errors, rate limits, documentation and tests, not only the code that returns JSON.
Webhooks
Signed events your partners can verify, with retries and a log of every delivery, sent only to public HTTPS addresses.
Payment Gateway Integration
eSewa, Khalti, Fonepay and bank QR in Nepal; PayPal or card abroad. Confirmed on the server, recorded exactly once.
Third-Party Integrations
SMS, email, maps, file storage, Google sign-in and AI models such as Gemini, each with retries, logging and tested failure cases.
API Documentation
Reference docs, guides with working examples and a changelog, so integrators don’t need to ask you how anything works.
Security Layer
Hashed keys with scopes, IP allowlists, expiry dates, rate limits, and browser requests refused for secret keys.
02REST or GraphQL
REST or GraphQL: Which Should You Use?
Use REST for most business APIs, public APIs and anything partners will integrate with, because it’s simple to cache, document and debug. GraphQL suits apps with many screens that each need a different slice of related data, when one developer or company controls both the app and the API.
| REST | GraphQL | |
|---|---|---|
| Best for | Public and partner APIs, payments, webhooks | Complex apps with many different screens |
| Caching | Simple, works with any CDN | Needs extra work |
| Documentation | OpenAPI, widely supported | Schema introspection |
| Learning curve for integrators | Low | Higher |
Every API I’ve shipped in production is REST, and I recommend GraphQL only when the screens clearly need it. If you already have a GraphQL API, I can extend it rather than start again.
03Case study
Case Study: The Eknas Public API
Eknas lets a shop’s POS, online checkout or own app record bills and redeem loyalty rewards through a public REST API, described in an OpenAPI 3.1 file. I designed it so that a bad network, a leaked key or a curious developer can’t cost the shop money or expose its customers.
Bills Recorded Exactly Once
Recording a bill or a redemption needs an Idempotency-Key. If the till retries after a dropped connection, the second request returns the original result with duplicate: true, and reusing a key for a different bill returns a clear 409 error.
Keys That Do as Little as Possible
Secret keys are stored only as keyed hashes and limited by 7 permission scopes. Voiding is off by default, a key can have an IP allowlist and an expiry, and requests from browsers are refused.
Webhooks Partners Can Trust
Every webhook is signed with HMAC-SHA256 and carries a timestamp with a 5-minute tolerance. Webhooks go only to public HTTPS addresses, never to private or local networks.
Privacy Built into the Responses
The API returns a customer’s first name and initial and only the last three digits of their phone. A number that doesn’t belong to the shop returns 404, so nobody can test numbers to see who uses Eknas.
04Payments
eSewa, Khalti & Fonepay Payment Integration
Payment gateway integration in Nepal starts here: most customers pay with eSewa, Khalti, Fonepay QR or a bank transfer, and buyers abroad use PayPal or a card. A payment integration has to confirm every payment on the server, record it exactly once, and leave a clear record when something fails.
The Customer Pays
In eSewa, Khalti, Fonepay QR or by card, for an order your server already created.
Order: pendingThe Wallet Redirects Back
The redirect says “success”, but anyone can type that address into a browser.
Not proof yetYour Server Checks
It asks the provider directly for the transaction’s status, amount and ID.
Verified on the serverRecorded Exactly Once
A unique transaction ID and an idempotency key stop double orders on refresh or retry.
Order: paidReceipt & Reconcile
A receipt or VAT invoice goes out, and a daily report matches orders to the provider’s records.
Reconciled daily
Money Rules I Follow
Products I’ve built take payment this way: Nimtto through Khalti, eSewa and Fonepay QR in Nepal and PayPal or card abroad, and Eknas through eSewa, Khalti, Fonepay or bank QR.
- Store money as whole numbers, as HeliGo Nepal keeps its ledger in paisa
- Plan partial refunds, receipts and VAT invoices from the start
- Log every call to the provider, with its response
- Keep test and live keys apart, on the server only
Building a store around these payments? See my web developer in Nepal page for online stores from NPR 60,000, or SaaS development for subscription billing in rupees.
05Security
How I Secure an API
In layers: strong sign-in and hashed keys, the narrowest permissions possible, validation and rate limits on every route, signed webhooks, and safe defaults for anything that calls out to the internet. Most layers come from products I’ve shipped.
Identity
- argon2id passwords and server-side sessions (Jhino)
- HttpOnly, SameSite cookies and CSRF tokens
- Google sign-in and email codes (RecruitFlow)
Limits
- Rate limits per route on sign-in, codes and AI chat (RecruitFlow)
- Scoped API keys with expiry (Eknas)
- Plan limits enforced on the server
Isolation
- Untrusted apps in a sandboxed iframe (Jhino)
- Outgoing webhooks to public HTTPS only (Eknas)
- AI access through staff permissions (Eutaa)
Visibility
- An audit log of important actions (Eutaa)
- Health checks and graceful shutdown (Jhino)
- Clear error codes integrators can act on
06Integrations
Integrations I Have Built
Third-party services I’ve connected in real products. If the one you need isn’t here, the method is the same: read the documentation, build the connection with retries and logging, and test the failure cases.
| Service | Used for | Project |
|---|---|---|
| Google Gemini | Resume scoring, trip planning, complaint triage from photos | RecruitFlow, HamroYatra, CivicSathy |
| Google OAuth | Sign-in with Google | HamroYatra, RecruitFlow |
| Resend | One-time sign-in codes by email | HamroYatra, RecruitFlow |
| Supabase | Auth, file storage and real-time chat | RecruitFlow |
| Cloudinary | Image uploads | HamroYatra |
| Cloudflare for SaaS | Custom domains with automatic certificates | Jhino |
| Model Context Protocol | AI assistants reading company data safely | Eutaa |
| Leaflet & OpenStreetMap | Maps and a complaint heatmap | CivicSathy |
| Formspree | Booking enquiries without a server | Hotel Aarohi |
Case studies: RecruitFlow, Jhino, Eutaa, CivicSathy, HamroYatra and Hotel Aarohi.
07API gateway
What’s an API Gateway, and Do You Need One?
An API gateway sits in front of your services and handles keys, rate limits and routing in one place. Most small and medium projects don’t need a separate gateway product, because the same checks can live in the API itself or at Cloudflare. I add one when several services share one public address.
Clients
- Your web app
- Your mobile app
- A partner’s POS
One Front DoorA gateway, or the same checks at Cloudflare
- API keys and scopes
- Rate limits per client
- Routing and logging
Services
- Orders API
- Payments
- AI service
HeliGo Nepal is a real example of the split: its AI trip planner runs as a separate FastAPI service, so bookings keep working if the AI is slow or down. Read the HeliGo Nepal case study.
08Process
How an API Project Works, Contract First
I write the contract before the code. We agree the endpoints, data and errors in an OpenAPI file, I build and test against it, and you get working documentation and keys at the end.
- 01
Contract First
Endpoints, fields, errors and permissions agreed in an OpenAPI file.
- 02
Build & Test
Each endpoint tested, including retries, bad input and expired keys.
- 03
Document
Reference docs and guides with working examples for integrators.
- 04
Hand Over
Keys, dashboards, logs and the repository, in your name.
09Pricing
How Much Does API Development Cost in Nepal?
A single integration into an existing system is quoted after I’ve seen the code, because the effort depends far more on that system than on the API itself. API work inside a new product is part of the build.
| Project | Price | Timeline |
|---|---|---|
| Payment gateway integrationeSewa, Khalti, Fonepay or bank QR into an existing site | Quoted per integration | After I see the code |
| API or webhook for partnersDocumented in OpenAPI, with keys and signed webhooks | Quoted per module | Agreed in writing |
| SaaS product with its APIAccounts, plans, payments and an admin console | NPR70,000 | 6–12 weeks |
Not included: provider fees from eSewa, Khalti, Fonepay or banks, hosting and paid services. Clients abroad are quoted in USD. All prices are on my services page; the data side is on my database design page.
FAQ: API Development in Nepal
Cost, payments, security and documentation, answered before you ask.
Ask me on WhatsAppHow Much Does API Development Cost in Nepal?
A single integration into an existing system, such as a payment gateway or an SMS provider, is quoted after I’ve seen your code, because the effort depends far more on that system than on the API. API work inside a new product is part of the build; a SaaS product’s first version starts from NPR 70,000.
Can You Integrate eSewa, Khalti and Fonepay into My Website?
Yes. I connect eSewa, Khalti, Fonepay QR and bank transfer for customers in Nepal, and PayPal or card for buyers abroad. Every payment is confirmed on the server and recorded exactly once, so a refreshed page or a retried request can’t create a second order. Developers can follow my eSewa and Khalti payment integration guide.
How Do You Stop a Payment Being Recorded Twice?
Three ways together. The server confirms the payment with the provider instead of trusting the redirect. Each transaction ID is unique in the database. And requests that create money records need an idempotency key, so a retry returns the first result, as in the Eknas API, instead of adding a second record.
Should My Project Use REST or GraphQL?
Use REST for most business APIs and for anything partners will integrate with, because it’s simple to cache, document and debug. GraphQL suits an app with many screens that each need a different slice of related data, when the same people control both the app and the API.
How Do You Document an API?
I write an OpenAPI file that describes every endpoint, field, error and permission, as I did for the Eknas public API in OpenAPI 3.1. Developers can import it into Postman or a code generator, and I add short guides with working examples for the common tasks.
How Do You Keep an API Secure?
Keys are stored only as hashes, each key gets the narrowest permissions it needs, and sensitive routes have rate limits. Input is validated on every request, webhooks are signed, and outgoing calls only go to public HTTPS addresses. Secret keys never go to the browser.
What’s a Webhook, and How Do You Sign One?
A webhook is a message your system sends to another when something happens, such as a bill being recorded. I sign each one with HMAC-SHA256 and a timestamp, as in Eknas, so the receiver can check it really came from you and isn’t an old message replayed after five minutes.
Can You Connect My System to a POS, an ERP or Another API?
Yes. I read the other system’s documentation, build the connection with retries and logging, and give you a simple status view so you can see when a sync fails and why. If the other system has no API, we can look at file exports or webhooks instead.
What’s an API Gateway, and Do I Need One?
An API gateway sits in front of your services and handles keys, rate limits and routing in one place. Most small and medium projects don’t need a separate gateway product, because the same checks can live in the API itself or at Cloudflare. I add a gateway when several services share one public address.
Can You Fix or Extend an Existing API?
Yes. I read the code and any current docs first, add tests around the endpoints you rely on, then fix or extend without breaking existing clients, using a new version where a change would. If there’s no documentation, I write an OpenAPI file as part of the work.
Tell Me What You Need to Connect.
I’ll Write the Contract First.
Send a short note about the systems involved, the data that needs to move and your deadline. I reply within one working day with questions or a first estimate.
Ujjwal RupakhetiReplies within one working day
What do you need?
Opens WhatsApp with your message started.