Trust Passport for platforms

What the Passport is

• Free for sellers

  Every Siiqo seller gets a Trust Passport. Paying never adds points.

• Earned by usage

  The score (0–1000) comes from completed orders, on-time delivery, reviews and replies. It can't be bought.

• Signed

  Every response includes a signed statement (ES256 JWS), so you can prove what Siiqo said and when.

Quick start

Fetch a seller's Passport by store slug. Send your API key in the X-Siiqo-Api-Key header.

curl https://api.siiqo.com/api/passport/<store_slug> \
  -H "X-Siiqo-Api-Key: <your_api_key>"

{
  "passport": {
    "store_slug": "adafabrics",
    "store_name": "Ada Fabrics",
    "url": "https://siiqo.com/id/adafabrics",
    "tier": "GOLD",
    "score": 812,
    "score_max": 1000,
    "verified": true,
    "business_registered": true,
    "completed_orders": 128,
    "member_since": "2025-03-02"
  },
  "statement": "eyJhbGciOiJFUzI1NiIsImtpZCI6Ii4uLiJ9.eyJ...",
  "alg": "ES256"
}

Verify a statement

Send the statement back to check it is genuine and not revoked, or verify it yourself with our public keys.

curl -X POST https://api.siiqo.com/api/passport/verify \
  -H "Content-Type: application/json" \
  -d '{"statement": "<statement>"}'

{
  "valid": true,
  "revoked": false,
  "claims": { "store_slug": "adafabrics", "score": 812, "tier": "GOLD", "verified": true }
}

ES256 public keys (JWKS):

https://api.siiqo.com/api/passport/.well-known/jwks.json

Embeddable badge

Show the live badge on any page. It links to the seller's public Passport.

<a href="https://siiqo.com/id/<store_slug>">
  <img src="https://api.siiqo.com/api/passport/<store_slug>/badge.svg" alt="Siiqo Trust Passport">
</a>

Check API

Look up a seller by phone number, @handle, store link or Pay Link, or by bank account. Returns matching Passports. siiqo.com/check

# By phone number, @handle, store link or Pay Link
curl "https://api.siiqo.com/api/check?q=%40adafabrics" \
  -H "X-Siiqo-Api-Key: <your_api_key>"

# By bank account
curl "https://api.siiqo.com/api/check/account?bank_code=058&account_number=0123456789" \
  -H "X-Siiqo-Api-Key: <your_api_key>"

{
  "query_type": "handle",
  "found": true,
  "results": [
    { "passport": { "store_slug": "adafabrics", "store_name": "Ada Fabrics", ... }, "matched_on": "handle" }
  ]
}

API v1

Send your key as Authorization: Bearer <key>. Every answer carries a signed statement and X-Siiqo-Quota headers.

curl https://api.siiqo.com/v1/businesses/<store_slug>/trust \
  -H "Authorization: Bearer <your_api_key>"

{
  "business": { "store_slug": "adafabrics", "store_name": "Ada Fabrics", "tier": "GOLD", "score": 812, "score_max": 1000, "verified": true, ... },
  "statement": "eyJhbGciOiJFUzI1NiIsImtpZCI6Ii4uLiJ9.eyJ...",
  "alg": "ES256"
}

Look up a phone number, @handle, store link, Pay Link or bank account ("058:0123456789"). The answer says found or not_on_siiqo, never which detail matched.

curl -X POST https://api.siiqo.com/v1/lookup \
  -H "Authorization: Bearer <your_api_key>" \
  -H "Content-Type: application/json" \
  -d '{"identifier": "@adafabrics"}'

{ "match": "found", "business": { ... }, "statement": "...", "alg": "ES256" }
{ "match": "not_on_siiqo" }

trust.js widget

The badge shows only on websites the seller has verified on Siiqo. Add the snippet to your page:

<div data-siiqo-passport="<store_slug>"></div>
<script src="https://siiqo.com/trust.js" async></script>

Test keys

Test keys never read real sellers. They answer from these fixtures and are never billed:

test-trusted-store   (GOLD, verified)
test-new-seller      (NEW, no score)
test-unverified      (SILVER, not verified)
anything else        -> 404 NOT_FOUND / not_on_siiqo

Lookup: +2348000000001, @test_trusted_store, 058:0000000001 -> test-trusted-store
        +2348000000002, @test_new_seller -> test-new-seller
        +2348000000003, @test_unverified -> test-unverified

Errors

401 UNAUTHORIZED / INVALID_KEY

No key, or the key is wrong or revoked.

404 NOT_FOUND

No public Trust Passport for that business.

429 RATE_LIMITED

Too many requests this minute. Retry after the Retry-After seconds.

429 QUOTA_EXCEEDED

The key has used this month's requests.

Evidence API: report sales outcomes

Platforms with a live key can send signed sales outcomes about a Siiqo seller: completed, delivered on time, refunded, or a dispute and who was at fault. The seller's record elsewhere can then count on their Trust Passport.

How reports count

• A report counts only after the seller accepts your platform on their Trust tab. They can stop it at any time.
• Reports weigh less than sales on Siiqo: together, partners move a Trust Score by at most 10 of 100 points, and one platform by at most half of that.
• Reports never give a score to a seller without their own sales history on Siiqo, and never lift a dispute limit.
• A key owned by the seller, or by someone linked to them, never counts.
• Siiqo can slow down or stop a platform whose reports conflict with what happened on Siiqo or that sellers dispute.

1. Create a signing secret

One per API key, shown once. Creating a new one replaces the old one at once.

curl -X POST https://api.siiqo.com/v1/evidence/secret   -H "Authorization: Bearer <your_api_key>"

{ "secret": "evsec_...", "secret_prefix": "evsec_AbCdEf", "created_at": "..." }

2. Send an outcome

Sign the raw body with your secret, the same way our webhooks are signed. Requests more than 5 minutes old are refused. Re-sending the same id is safe: it is stored once.

BODY='{"id":"evt_123","type":"order.completed","seller":{"slug":"adafabrics"},"order_ref":"A-1001","occurred_at":"2026-10-31T09:00:00Z","amount":25000,"currency":"NGN","buyer_ref":"cust_88"}'
T=$(date +%s)
SIG=$(printf "%s.%s" "$T" "$BODY" | openssl dgst -sha256 -hmac "<your_evidence_secret>" | sed 's/^.* //')

curl -X POST https://api.siiqo.com/v1/evidence   -H "Authorization: Bearer <your_api_key>"   -H "Content-Type: application/json"   -H "Siiqo-Signature: t=$T,v1=$SIG"   -d "$BODY"

201 { "status": "stored", "id": "evt_123", "evidence_id": 991, "seller": { "slug": "adafabrics" }, "seller_link": "pending" }
200 { "status": "duplicate", "id": "evt_123", ... }
200 { "status": "validated", "stored": false, "test": true, ... }   (test keys)

Test keys

Test keys are checked in full (signature, body, seller) and nothing is stored. Use the fixture slugs test-trusted-store, test-new-seller or test-unverified.

Evidence errors

401 BAD_SIGNATURE

Missing or wrong Siiqo-Signature.

401 SIGNATURE_EXPIRED

The signature time is more than 5 minutes from Siiqo's clock.

409 NO_SIGNING_SECRET

Create a secret first: POST /v1/evidence/secret.

409 IDEMPOTENCY_CONFLICT

This id was already used for a different event.

404 SELLER_NOT_FOUND

No seller matches that slug, or a verified domain or handle.

403 PARTNER_REVOKED

Siiqo has stopped accepting reports from this key.

400 BAD_REQUEST

Some fields are not valid; see errors.

Plans for platforms

The Passport and trust score are free for sellers and never depend on payment. Platforms pay only for more API volume.

For Scale, email developers@siiqo.com.

Display rules

• Never call a seller "safe". Show what is verified and what is earned.
• Show the Verified mark only when verified is true.
• When score is null, show "New seller", not a number.

Plugins

• ShopifyComing soon
• WooCommerceComing soon
• ChatGPTComing soon