Developer workflows should feel routed, signed, and ready.

Infrastructure becomes visible.

Developer Operations

API routes become a visible integration system.

Webhooks, mobile APIs, branded routing, and sandbox lanes move as one system.

App registersScopes selectedHost verifiesRouting proves itselfEvents signReplay remains safeSandbox livesPartners can shipMobile releasesPreview to store

Routing Model

One host carries every integration.

Business UI, members mobile, door routes, webhook delivery, and sandbox calls stay on the branded domain.

Branded hosthttps://{brand}.app.{env}.gohexafit.commembers, signup, business UI, and /api/*.

HQ hosthttps://hq.app.{env}.gohexafit.comPlatform control plane only.

Door routehttps://{brand}.app.{env}.gohexafit.com/api/door/*Device scope comes from hostname.

API contracts11 current members and developer routes

MethodRoutePurpose

POST/api/mobile/loginMember mobile login

GET/api/mobile/dashboardMember dashboard summary

GET/api/mobile/qrShort-lived access QR token

POST/api/mobile/pay-nowIdempotent open-balance payment

PUT/api/mobile/preferencesPush and messaging preferences

POST/api/mobile/wallet/issueApple or Google wallet pass issuance

GET/api/developer/apps/meVerify a developer app key against the branded host

GET/api/enterprise/integrations/developer-eventsDiscover subscribable partner-event contracts

PUT/api/enterprise/integrations/developer-appsRegister or update a developer app

POST/api/enterprise/integrations/developer-apps/{appId}/rotate-credentialsRotate API key and webhook signing secret

GET/api/enterprise/integrations/developer-apps/{appId}/sandboxGenerate business-specific sandbox onboarding instructions

Launch railSandbox call to live rollout

Register appChoose scopes, issue credentials, and set the webhook URL.

Verify branded hostProve routing and auth on the branded hostname.

Load sandbox guidePull sample headers, payloads, and checklist steps.

Promote to productionRotate credentials, sign webhooks, and release.

Platform guaranteesBranded routing, signed events, replay-safe delivery

Branded host firstPartner traffic stays on the business host.

Replay-safe deliveryRetries, redrive, idempotency, and signatures are built in.

Migration adaptersMindbody, Glofox, TeamUp, Zen Planner, PushPress, WellnessLiving, and Wodify.