Public API - Krti

The public API is what krti.js reads. It needs no secret: a public key identifies the store, and every answer is the same for every shopper.

Environment	Base URL	Keys
Production	`https://api.krti.com`	`pk_live_...`
Sandbox	`https://sandbox-api.krti.com`	`pk_test_...`

Conventions

JSON responses. Errors are application/problem+json (RFC 9457) with a stable code; the detail text is for humans and may change.
Money is a decimal string with the currency’s number of decimals (KWD has 3), next to a currency field. Never a float.
GET /public/promo allows any browser origin (Access-Control-Allow-Origin: *, no credentials) and is cacheable for 60 seconds.
Rate limits: 600 requests per minute per key and 60 per minute per client IP. Past them the answer is 429 too_many_requests with a Retry-After header; wait that long before asking again.
Language: ?lang=ar|en, else the Accept-Language header, else English. Only the shopper facing strings follow it.

Status	`code`	When
404	`key_not_found`	Unknown or revoked key, a key of the other environment, or a merchant that is not active
422	`validation_failed`	A missing or malformed parameter; `detail` names it
422	`currency_mismatch`	The currency is not the store’s
429	`too_many_requests`	A rate limit; see `Retry-After`