Public API
Authentication
Every request must include an API key. The tenant is derived from the key — never send a tenantId.
API keys
Never put a sk_live_ key in browser code, a public repo, or a NEXT_PUBLIC_ variable. The raw key is shown once — we store only a SHA-256 hash.
| Type | Prefix | Where it lives | Capabilities |
|---|---|---|---|
| Publishable | pk_live_ | Browser / client | Read menu & locations, create orders |
| Secret | sk_live_ | Your server only | Everything above + read orders |
Sending the key
Prefer the Authorization header. X-Api-Key is also accepted.
http
Authorization: Bearer sk_live_xxxxxxxxxxxx
# or
X-Api-Key: sk_live_xxxxxxxxxxxxOrigin allowlist (publishable)
Publishable keys require registered domains. If the request includes an Origin header that is not on the allowlist, it is rejected — so a scraped key cannot be used from another site.