# Hekk

> Hekk is a services marketplace connecting skilled providers (plumbers, electricians, AC/HVAC technicians, IT/network technicians, carpenters, painters, and more) with customers in Bahrain. Customers browse providers by category, see each service's "starting from" price and rating, send a request, and connect directly with the provider. Hekk connects the two parties — it does not mediate price negotiation or take payment at launch.

## How it works

- Customers browse by service category, each provider showing a "starting from" price, rating, and trust badges.
- A customer accepts the starting price up front (no bidding or negotiation), shares an address, location, and contact, then sends a request.
- The provider accepts or declines. On acceptance the two coordinate directly, including via an in-app coordination chat. Either party can mark the job completed, which opens a review.
- Trust badges are derived from verified facts: Licensed, Valid CR (commercial registration), Freelancer, Local freelancer, Top-rated, and Newcomer.

## For AI agents (Agent Gateway)

If you are an autonomous AI agent acting on behalf of a human, do NOT scrape the human web UI. Use the Hekk Agent Gateway, which runs the full lifecycle (discover → quote → book → coordinate → complete → pay → review) within limits the human sets via OAuth consent and spend caps.

- Gateway overview: https://hekkapp.com/en/agents
- MCP endpoint (Streamable HTTP): https://hekkapp.com/agents/mcp
- REST API base + tool descriptor: https://hekkapp.com/api/agent/v1
- OAuth2 (authorization-code + PKCE) discovery: https://hekkapp.com/.well-known/oauth-protected-resource and https://hekkapp.com/.well-known/oauth-authorization-server
- Authority is a scoped, revocable OAuth grant bound to one human account — never a global key. Over-cap or first-time-provider actions require human confirmation. Reviews must be the human's genuine input.

### If your human has no Hekk account yet (autonomous quickstart)

The gateway binds to an EXISTING human customer account. If the human you act for has none:

1. Create their customer account with `POST https://hekkapp.com/api/v1/customers/signup` (JSON: fullName, displayName or useRealName, email, phone in Bahrain format, password ≥ 6 chars) and send the header `X-Hekk-Agent: 1` so the account is honestly attributed as agent-created. Use the human's REAL contact details — they receive booking notifications there.
2. Register your agent app once at https://hekkapp.com/en/agents/developers (yields a `client_id`; exact redirect URIs required).
3. Have the human approve the OAuth consent at https://hekkapp.com/en/agents/connect (they sign in with the account from step 1 and set scopes and spend caps).
4. Exchange the code at the token endpoint and call the tools. Full walkthrough: https://hekkapp.com/auth.md

If you skip the gateway and act through the human web UI anyway, declare yourself: tick the "I am an AI agent" checkbox on the signup form (or send `X-Hekk-Agent: 1` on API signup). Undeclared automation is detectable and reviewed by admins.

## Key pages

- [Home](https://hekkapp.com/en): overview of Hekk and how it works.
- [Browse services](https://hekkapp.com/en/browse): all service categories.
- [All providers](https://hekkapp.com/en/providers): the full directory of approved providers.
- [Agent Gateway](https://hekkapp.com/en/agents): connect an AI agent or build on Hekk.
- [About](https://hekkapp.com/en/about): about the platform.
- [Privacy policy](https://hekkapp.com/en/privacy): how customer and provider data is handled.
- [Terms of service](https://hekkapp.com/en/terms): terms of use.

## Notes

- Languages: Arabic (default, RTL) and English (LTR). The same pages are available under /ar and /en path prefixes.
- Region: Bahrain. Currency: Bahraini Dinar (BHD).
- Prices shown are indicative "starting from" prices; final terms are agreed directly between customer and provider, off-platform.
- Account deletion (PDPL / data rights): a signed-in customer can delete their own account with `DELETE https://hekkapp.com/api/v1/customer/me` (JSON body: { "password": "..." } to confirm). PII is anonymized, the account is deactivated and every session is revoked. Full contract in the OpenAPI spec at https://hekkapp.com/api/openapi under /v1/customer/me.
- Clients calling any URL by hand must percent-encode non-ASCII query strings (e.g. Arabic search terms): raw UTF-8 bytes in a URL are rejected by the HTTP layer with an empty 400 before the application sees them. Browsers do this automatically.
- Authenticated areas (the admin dashboard, and the provider and customer app areas) and the human-facing API are not part of the public content and are excluded from indexing. The Agent Gateway above is the supported machine interface.