Authentication

Send your API key as a Bearer token on every request:

Authorization: Bearer sk_live_EXAMPLE_KEY

If the header is missing or malformed:

{
  "error": "Unauthorized",
  "code": "UNAUTHORIZED",
  "message": "Send your API key as a Bearer token."
}

If the key is unknown, revoked, or its backing cashier row is disabled:

{
  "error": "Unauthorized",
  "code": "UNAUTHORIZED",
  "message": "That API key isn't valid."
}

Both cases return HTTP status 401.

Revoking a key

Open the Developers (Geliştiriciler) page in the dashboard and choose Revoke (İptal et) from the row menu for that key. Once revoked, every request made with that key immediately returns 401. Keys are stored on the server only as cryptographic hashes, so a lost key cannot be recovered.

Key permissions

An API key acts with cashier privileges at the location it is bound to: it can scan QR codes, award points or stamps, redeem rewards, and void its own entries within the 15-minute void window. It cannot access management endpoints such as reports, program settings, or team administration.