Browser / static site

const API = "https://www.kitchensflow.com/api/public/v1";
const PK = "pk_live_xxxxxxxxxxxx"; // safe to expose

async function submitOrder(cart, customer) {
  const res = await fetch(`${API}/orders`, {
    method: "POST",
    headers: {
      Authorization: `Bearer ${PK}`,
      "Content-Type": "application/json",
    },
    body: JSON.stringify({
      items: cart.map((line) => ({
        productId: line.productId,
        quantity: line.quantity,
        selectedOptions: line.selectedOptions?.map((opt) => ({
          groupId: opt.groupId,
          optionId: opt.optionId,
          quantity: opt.quantity,
        })),
      })),
      customer,
      paymentMethod: "pay_at_pickup",
      idempotencyKey: crypto.randomUUID(),
    }),
  });

  if (!res.ok) throw new Error((await res.json()).error.message);
  return (await res.json()).order;
}