API keys and webhooks
Linking other software (accounting, apps, websites): API keys with permissions, and webhooks that tell another system about every order.
Both are under Advanced and only the owner sees them. The details for developers are in the API documentation (/api/docs).
API keys
- API keys → New key. Give it a Name (e.g. Accounting) and pick the Permissions: Menu: read, Menu: change, Orders: read, Orders: create/status, Calls: caller ID (phone system), Hotel PMS: rooms, stays, room charges (with the Hotel PMS link add-on, see Hotel API for PMS vendors).
- Copy the key at once: it will not be shown again.
- The other software sends it as
Authorization: Bearer ….
Give only the permissions that are needed. The Last used column shows whether it is in use. With Revoke, whatever uses the key stops at once.
Webhooks
Another system hears at once about the Events you pick: new online order, accepted, rejected, ready, paid / closed, cancelled, and room charge (Hotel PMS).
- The address must be https and answer 2xx within 10 seconds.
- If it fails, it is retried 5 times. After 20 failures in a row the webhook is switched off.
- Every call is signed with the webhook's Secret (X-Ikaros-Signature header, HMAC-SHA256). Check the signature before accepting the call.
- Test sends a test call. Last sent and Last error show what happened.