Developers

Build on Sika

Programs you write can read Sika's public spaces and, through a bot, post in public channels. Private chats, files and calls can never be reached: they are end to end encrypted and our servers hold no keys to them.

What you can do

Read public channels. Channels, their posts, halls and forums are public. Anyone can read them without an account or a key, and every post is signed by the Sika key that wrote it, so you can check who wrote what.

Post as a bot. A bot has a Sika key of its own. A channel owner names the bot as an admin of the channel, and then your program can post text there. Posts by a bot are public and marked Bot in the app.

What is not possible. A bot cannot join, read or write a private chat or a group. There is no endpoint that lists a person's followers or members. This is not a setting we may change later: it follows from how Sika is built.

Get a key

Open Sika, then Settings, Developers. Create a key and copy it at once: it is shown only one time, and we keep only a scrambled fingerprint of it. A lost key is revoked and replaced, never recovered. Revoking a key stops it at once.

Keep a key like a password. Never put it in an app you give to other people or in a web page.

Make a bot

In Settings, Developers, create a bot and give it a name people will recognise.
Copy the bot's Sika key (64 characters) and give it to the owner of the channel.
The owner opens the channel settings, taps Add a bot by its key, pastes it and saves. The bot is now an admin of that channel and can post there. It cannot change the channel.
Deleting a bot stops it posting at once. The posts it already made stay.

Bots in halls

A bot can also take part in the forum of a public hall. It joins the hall first, like any member, and then starts topics and answers them. The hall's elders can lock a topic or remove a bot's post, and an upheld report freezes the bot, as in channels.

POST /v1/bots/BOT_ID/halls    {"hall": "HALL_ID"}
POST /v1/bots/BOT_ID/topics   {"hall": "HALL_ID", "title": "Market prices today", "text": "Tomatoes 500 a basket"}
POST /v1/bots/BOT_ID/replies  {"topic": "TOPIC_ID", "text": "Thanks, noted."}

Topics and replies count towards the bot's posts for the day. A refused call answers 422 with the reason, such as join_first (the bot has not joined the hall) or locked.

Using the API

Send your key as a bearer token. The service address is shown in Settings, Developers.

curl -H "Authorization: Bearer sika_live_YOUR_KEY" https://DEV_HOST/v1/whoami

This answers with your key, your account, your plan, its limits and today's use. To post as a bot:

curl -X POST https://DEV_HOST/v1/bots/BOT_ID/posts \
  -H "Authorization: Bearer sika_live_YOUR_KEY" \
  -H "Content-Type: application/json" \
  -d '{"channel": "CHANNEL_ID", "text": "Rain expected in Accra this afternoon."}'

A post is text up to 4,000 characters. A successful post answers 201 with its id. If the channel does not name your bot as an admin, the answer is 422 with not_an_admin.

Webhooks

On Builder and Business, Sika can tell your server when something happens in a public channel your bot administers. In Settings, Developers, set an address for the bot. It must be an https address on the public internet: addresses that point inside a network (such as localhost or 10.x.x.x) are refused, and so are addresses with a login in them or an unusual port.

Three kinds of event exist: post.created (someone else posted in the channel), reaction.added (the emoji and the totals, never who reacted) and channel.followed (the new follower count, never who followed). Each carries only what is already public. A bot is not told about its own posts.

Every delivery is a POST with a JSON body and these headers: Sika-Event (the kind), Sika-Delivery (a unique id, so you can ignore a repeat) and Sika-Signature, which looks like t=1700000000,v1=3f2a.... The signature is the HMAC-SHA256, with your bot's signing secret, of the time, a dot and the exact body. Check it, and refuse a time more than five minutes old.

expected = HMAC_SHA256(secret, t + "." + raw_body)  // hex
valid = constant_time_equal(expected, v1) and abs(now - t) <= 300

The signing secret (it starts with whsec_) is shown once, when you save the address, and can be replaced with a new one at any time. Answer with any 2xx status within five seconds. If you do not, Sika tries again after 30 seconds, 5 minutes, 30 minutes, 2 hours, 8 hours and 12 hours, then gives up on that event. If ten events in a row are given up, the webhook is switched off until you save its address again. Use Send a test event to check your address and your signature check.

Plans and limits

Plan	Price a month	Keys	Requests a day	Bots	Posts per bot a day
Free	Nothing	1	1,000	1	20
Builder	NGN 5,000	5	100,000	5	500
Business	NGN 50,000	20	2,000,000	50	5,000

Builder and Business are paid a month at a time, in the app, on Flutterwave's page (card, bank transfer, USSD or mobile money). They never renew by themselves. When a paid month ends your account returns to Free. Paying for the plan you have adds a month to its end; paying for a higher plan starts it at once, and the time left on the lower one is not carried over. A lower plan cannot be bought while a higher one is running.

Errors

Answer	Meaning
401 `unauthorized`	The key is missing, wrong or revoked.
429 `rate_limited`	Too many requests this minute. Wait 60 seconds.
429 `daily_limit`	Your plan's requests for today are used. The count restarts at midnight UTC.
429 `bot_daily_limit`	This bot reached its posts for today.
404 `not_found`	No such bot for your account.
400 `invalid_input`	The body was not what the call expects.
422 with a reason	The public service refused the post: `not_an_admin`, `channel_hidden`, `too_many_posts`, `prohibited` or `bot_frozen`.

Rules

Bots follow the same rules as everyone: no illegal goods, no harassment, no deception about who runs the bot. Posts by bots can be reported like any post. A bot with enough upheld reports is frozen, and a frozen bot cannot post. Do not collect people's data through a bot. Do not use a key to try to reach private chats; there is nothing there to reach.

We may change the limits and plans with notice in the app. Using the developer tools means you accept the Terms of Use.

Questions

Write to support@sikaos.app. To report a security problem, see Security.