Insights · Keshio
Business Ledger API: consented events, not raw SMS
Keshio’s Business API lets merchants reconcile with structured payment events from phones that opted in—while SMS stays on the device.
Why a Business API exists
Daraja and similar rails cover many M-Pesa merchant flows—but Sacco SMS, bank alerts, and missed C2B callbacks still leave gaps. Keshio already structures those messages on the phone. The Business Ledger API exposes only consented events to systems you control, for auto-reconcile.
Base URL: https://api.keshio.app
What merchants get
- Structured payment events (credits, debits—scopes you enable)
- Pull with a machine API key:
GET /v1/events - Optional HTTPS webhooks with HMAC signatures
- A developer console on the same host (Google sign-in, same account as the app)
What merchants do not get: SMS bodies, inbox access, or data from phones that never opted in.
How a person opts in
- Use Keshio Pro on Android
- Enable Business Ledger sharing in the app and pick wallets / scopes
- Create an API key (console or app)—plaintext shown once
- Pull events or register a webhook URL
Consent lives with the person. Turning sharing off stops new pushes; machines that still hold an old key fail closed once the connection is disabled.
How this fits with household and AI agents
These are three different doors—same privacy idea:
| Surface | Who it is for | What leaves the phone |
|---|---|---|
| Business API | Merchant / back-office systems | Consented event fields you approved |
| Household | Partner / family | Selected goals and budgets only |
| AI agents | Grok or any MCP connector | A redacted summary you configure |
None of them upload raw SMS for parsing. You turn each on separately.
Quick pull example
curl -sS "https://api.keshio.app/v1/events?limit=50" \
-H "Authorization: Bearer keshio_live_YOUR_KEY"
Paginate with ?cursor= from the previous page. Webhook deliveries include X-Keshio-Timestamp and X-Keshio-Signature (t=<ts>,v1=<hmac> over {timestamp}.{raw_body}).
Open the console
Sign in at api.keshio.app with the same Google account as the app, then manage keys, webhooks, and recent events.
Unlock Keshio Pro · Privacy policy · Household monitoring · AI agents