Public API
Authentication
Every request must include an API key. The tenant is derived from the key — never send a tenantId.
API keys
Never put a sk_live_ key in browser code, a public repo, or a NEXT_PUBLIC_ variable. The raw key is shown once — we store only a SHA-256 hash.
| Type | Prefix | Where it lives | Capabilities |
|---|---|---|---|
| Publishable | pk_live_ | Browser / client | Read menu & locations, create orders |
| Secret | sk_live_ | Your server only | Everything above + read orders |
Sending the key
Prefer the Authorization header. X-Api-Key is also accepted.
http
Authorization: Bearer sk_live_xxxxxxxxxxxx
# or
X-Api-Key: sk_live_xxxxxxxxxxxxOrigin allowlist (publishable)
Publishable keys require an Origin header that matches a registered domain. Requests without Origin (curl, scripts) or with an unlisted Origin are rejected with 403 origin_not_allowed — so a scraped pk_live_ key cannot be used outside the allowlist. Secret keys are server-to-server and are not origin-restricted.