Developers

The Jalopy API

Book cars from your own systems, sync the fleet into payroll or HR, and hear about trips, prestarts and defects the moment they happen.

An owner makes a key in the portal (Settings → Developers) and ticks what it can do.
Send it as Authorization: Bearer jy_… to https://app.jalopy.app/api/v1.
Add webhooks in the same place to get events pushed to you, signed.

openapi.json (OpenAPI 3.1): import it into Postman, n8n or your own code generator.

curl Book a car

curl https://app.jalopy.app/api/v1/bookings \
  -H "Authorization: Bearer $JALOPY_KEY" \
  -H "Idempotency-Key: payroll-7731" \
  -H "Content-Type: application/json" \
  -d '{
    "vehicle": "…",
    "driver": "…",
    "origin_location": "…",
    "destination_address": "Ipswich QLD",
    "purpose_category": "…",
    "depart_at": "2026-10-16T22:30:00Z",
    "return_at": "2026-10-17T02:30:00Z"
  }'

Node Check a webhook came from Jalopy

import { createHmac, timingSafeEqual } from 'node:crypto'

// rawBody: the body exactly as received, before JSON.parse
function fromJalopy(rawBody, header, secret) {
  const p = Object.fromEntries(
    header.split(',').map((x) => x.split('='))
  )
  // older than five minutes: a replay
  if (Math.abs(Date.now() / 1000 - Number(p.t)) > 300) return false
  const want = createHmac('sha256', secret)
    .update(`${p.t}.${rawBody}`)
    .digest('hex')
  return timingSafeEqual(Buffer.from(want), Buffer.from(p.v1 ?? ''))
}

Reference

Choose Authorize and paste a key to try calls against your own fleet. Webhook payloads are at the bottom.

Loading the reference…