connecthub/Overview
Sign inPartner console
Partner integration

Integrate with DinePro & StayPro

Push aggregator orders into any authorized restaurant, read its live menu, and receive signed status updates the moment the kitchen marks an order Ready. One REST API, one order spine — the same path a website, POS, or kiosk order takes.

Sandbox ready API v1.0.0 · stable OAuth2 · HMAC-signed webhooks OpenAPI spec ↗ Postman collection ↓ TypeScript SDK ↓

Quickstart

four calls from zero to a live two-way order flow
1

Get a token

Exchange your client ID & secret for a scoped access token.

POST /partner-oauth-token
2

Read the menu

Fetch a tenant's live, channel-priced menu — visible items only.

GET /partner-menu
3

Push an order

Ingest an order into the shared spine. Idempotent by your order id.

POST /partner-orders
4

Get status back

Register a URL; receive signed order.status_changed events.

POST /partner-webhooks
POST/functions/v1/partner-orders
scope: orders:write
# headers
Authorization: Bearer eyJhbGciOiJIUzI1Ni… (scoped access token)
Content-Type: application/json

// body
{
  "tenant_id": "bilgah-pizza",
  "shop_id": "6b1e…-shop",
  "provider": "wolt",
  "external_order_id": "WOLT-8821",
  "order_type": "delivery",
  "items": [
    { "product_id": "marg-…", "quantity": 2, "unit_price": 9.90 }
  ]
}

API keys

sandbox
chub_live_5f2a9c7d…e71b
••••••••••••••••
directory:readmenu:read orders:readorders:write webhooks:manage

Real, auto-granted to the connecthub-demo tenant — the secret is shown once.

Webhooks

durable delivery with automatic retry & dead-letter
https://your-app.example.com/webhooks/dinepro
Signing secret whsec_9c…
EventProviderStatusAttemptsSignatureWhen
order.status_changedWoltDelivered1t=…,v1=8f3c…just now
order.status_changedBolt FoodDelivered1t=…,v1=1a09…2 min ago
stop_list.changedWoltDelivered1t=…,v1=c910…5 min ago
order.status_changedWoltRetrying3 / 6t=…,v1=b27e…next in 8 min
order.status_changedBooking.comDead-letter6 / 6t=…,v1=44da…↻ Replay

Delivery logs & replay

Inspect & retry. List recent attempts with GET /partner-webhooks?tenant_id=…&resource=deliveries (status · attempts · last error). Re-queue a dead or failed one with POST /partner-webhooks {"action":"replay","delivery_id":"…"} — you can only replay your own deliveries. Subscribe to order.status_changed and stop_list.changed.
Verify every event. Each delivery is signed t=<unix>,v1=HMAC‑SHA256(t.payload) with your endpoint's signing secret. Reject anything that doesn't match — that's how you know it came from DinePro.
import crypto from 'node:crypto';
// req.headers['webhook-signature'] = "t=1699…,v1=8f3c…"; raw = the exact request body string
function verify(sig, raw, secret) {
  const p = Object.fromEntries(sig.split(',').map(s => s.split('=')));
  const expected = crypto.createHmac('sha256', secret).update(`${p.t}.${raw}`).digest('hex');
  return crypto.timingSafeEqual(Buffer.from(expected), Buffer.from(p.v1));
}

What restaurants see

tenants connect to providers — your connector stays behind the scenes
W
Wolt
Connected · syncing menu
B
Bolt Food
Connected · 12 orders today
B
Booking.com
Onboarding · awaiting property id

Endpoints

every request is token-verified, scope-checked, and grant-gated · full schema in the OpenAPI spec
POST
/partner-oauth-token
Exchange client credentials for a scoped access token
no scope
GET
/partner-token-details
Inspect your token — scopes, environment, expiry & rate budget
any scope
GET
/partner-directory
Shops, order types & payment methods for a tenant
directory:read
GET
/partner-menu
Live, channel-priced menu — visible items only
menu:read
POST
/partner-orders
Ingest an order (idempotent) · GET to poll status
orders:write
POST
/partner-webhooks
Register a URL & receive its signing secret
webhooks:manage

Every authenticated response carries X-RateLimit-Limit · X-RateLimit-Remaining · X-RateLimit-Reset · X-Request-Cost so you always know your budget.

Reference

generated from the OpenAPI spec — expand an operation for parameters, schema & responses · ⌘K to search

Prefer Postman? Import the collection + sandbox environment — run Get token once and every request is pre-authorized.

Loading reference…

Changelog

what shipped, dated — the API is versioned v1.0.0
2026-08-10
v1.0.0 — developer experience
Published the machine-readable OpenAPI 3.1 spec; added the /partner-token-details diagnostics endpoint; every response now returns quota & cost headers.
new
2026-08-07
Partner API — first release
OAuth2 client-credentials, directory & menu reads, idempotent order ingest, and HMAC-signed outbound webhooks with retry & dead-letter.
stable
Built on the nextech hospitality platform · DinePro & StayPro