TshovaDevelopers

Your API keys, usage and webhooks — in one place.

OR

Read the API docs · tshova.co.zw

📬

Verify your email

We sent a link to . Click it, then continue.

TshovaDevelopers
Resources
API reference ↗ Webhook guide ↗ Errors ↗
developers@tshova.co.zw

Welcome 👋

Mint a key, drop it in your Authorization header, and start requesting rides across Zimbabwe from your own software.

—
Active keys
—
Rides via API
30/min
Create rate limit

Get started

✓
Create an API key
One secret, used as a Bearer token.
✓
Add a webhook
Get offers & status pushed to you.
✓
Request your first ride
POST /v1/rides with a fare you name.
Guide

Environment

Checking…
Base URLhttps://api.tshova.co.zw/v1
AuthAuthorization: Bearer <key>
Rate limit30 / min · 300 / hour (creates)
SigningHMAC-SHA256 · X-Tshova-Signature

Quickstart


        

Full reference, the ride lifecycle & webhooks → tshova.co.zw/api-docs

API keys

Send your key as Authorization: Bearer <key> to https://api.tshova.co.zw/v1. Keys are shown once at creation — rotate or revoke any time; changes take effect instantly.

Webhooks

Instead of polling, let Tshova POST events to your server. Set a default callback URL per key (a per-ride webhookUrl overrides it). Every delivery is signed so you can verify it's really us.

Events we send

offer.received

A driver sent an offer on your ride. Fetch offers and accept the one you like.

ride.status

The ride moved on — driver_arriving, arrived, in_progress, completed or cancelled.

Example payload & headers
Verify signatures ↗
POST your webhook URL
X-Tshova-Event: ride.status
X-Tshova-Signature: t=1700000000,v1=<hmac-sha256>

{
  "event": "ride.status",
  "rideId": "abc123",
  "status": "driver_arriving",
  "fare": 3.50,
  "driver": { "name": "Tafara M.", "plate": "ACZ 1234", "vehicle": "Honda Fit" },
  "trackUrl": "https://tshova.co.zw/t/xxxxx",
  "at": 1700000000000
}

Your endpoints

Recent deliveries

The last few events we POSTed to your endpoints, newest first — with the HTTP status we got back.

Usage

Rides requested through your keys. (Counts are cumulative — one per POST /v1/rides.)

—
Total API rides
—
Keys with traffic
—
Busiest key

Create an API key

Name it so you can tell keys apart.

Here's your key 🔑

Copy these now — for security we can't show the key again.

Store the key as a server secret. Anyone with it can request rides as you.

Edit webhook

Must be https. We block localhost and private/internal addresses.

Signing secret

••••••••••••
const crypto = require('crypto');
function verify(rawBody, header, secret){
  const [t,v1] = header.split(',').map(p=>p.split('=')[1]);
  const sig = crypto.createHmac('sha256', secret)
    .update(t + '.' + rawBody).digest('hex');
  return crypto.timingSafeEqual(Buffer.from(sig), Buffer.from(v1))
    && (Date.now()/1000 - t) < 300; // reject > 5 min old
}
Rolling replaces the secret immediately — update your server in the same breath or deliveries will fail verification.