Laayo for developers, APIs, engineering notes and reporting a security issue
Where developers can build with Laayo today, what we share about how we build, and how to tell us about a security problem responsibly.
Developers find Laayo for different reasons. Some want to accept payments, some want to connect a restaurant’s systems, some are curious how a delivery app for smaller towns is built, and a few have spotted something that looks wrong. This page answers each of those.
Does Laayo have a public API?#
The Laayo delivery app does not have a public API for placing or managing orders. Customers order through the Laayo app and website, and partners manage orders in the Laayo partner app.
Where developers can build with us today is payments, through Qora.
What is the Qora API?#
Qora, made by Laayo Services Pvt. Ltd., lets a business take QR payments and know right away when a customer has paid. For developers it offers:
- A REST API to create payments and check their status.
- Signed webhooks that tell your server when a payment succeeds, which your server can verify came from Qora.
- Documentation with a live console, where you can use your own key to create a real payment from the docs page and watch it complete.
- Payment links and counter QR posters for the parts of a business that do not need code.
Qora never holds customer money. Payments go straight to the merchant’s own account. The documentation is at qora.laayo.com.np, and there is a plain explanation in what is Qora.
Can a restaurant connect its own system to Laayo?#
Restaurants on Laayo Biz, our point of sale, are connected to Laayo already: delivery orders arrive in the POS and kitchen, and the kitchen’s progress goes back to the customer. See what is Laayo Biz. If your restaurant uses another system and you want to connect it, talk to our team through the partner app or [email protected].
Where can I read about how Laayo is built?#
This blog is where our engineering team writes. Good places to start:
- Laayo’s tech stack, a five part series from the servers up to the apps.
- Search that understands momo, on typo-tolerant dish search.
- How we estimate delivery time.
- Rider GPS that never gets stuck.
- The full Engineering section.
We write about decisions and trade-offs, not about internal details that would put our systems or partners at risk.
How do I report a security issue?#
If you think you have found a security problem in a Laayo app, website or Qora, please tell us privately.
- Email [email protected] with “Security” at the start of the subject.
- Describe what you found and the steps to see it, with the date and time you tested.
- Give us time to fix it before telling anyone else.
Please do not access, change or keep other people’s data, run tests that slow down or break our services, or try social engineering on our team, riders or partners. Test only with your own accounts. A person on our team will reply, and we will tell you when the issue is fixed. We are grateful to anyone who reports a problem responsibly.
Does Laayo hire developers?#
Laayo is a small team that builds its apps, backend, payments and point of sale in-house. If you would like to work with us, send a note through the contact form on our Investors page with “Something else” and tell us what you would like to work on.
Quick answers#
Does Laayo have a public ordering API?#
No. Developers can build with Laayo through the Qora payments API today.
Where are Qora’s API docs?#
At qora.laayo.com.np, with a live console that creates a real payment using your own key.
Does Qora send webhooks?#
Yes. Qora sends signed webhooks when a payment succeeds, and your server can verify them.
How do I report a security vulnerability to Laayo?#
Email [email protected] with “Security” at the start of the subject, describe the steps, and give us time to fix it before sharing.
Where can I learn about Laayo’s tech stack?#
Read the five part tech stack series at blog.laayo.com.np/tech-stack and the Engineering section of this blog.
