Get a token
Exchange your client ID & secret for a scoped access token.
POST /partner-oauth-tokenPush aggregator orders into any authorized restaurant, read its live menu, and receive signed status updates the moment the kitchen marks an order Ready. One REST API, one order spine — the same path a website, POS, or kiosk order takes.
Exchange your client ID & secret for a scoped access token.
POST /partner-oauth-tokenFetch a tenant's live, channel-priced menu — visible items only.
GET /partner-menuIngest an order into the shared spine. Idempotent by your order id.
POST /partner-ordersRegister a URL; receive signed order.status_changed events.
# headers Authorization: Bearer eyJhbGciOiJIUzI1Ni… (scoped access token) Content-Type: application/json // body { "tenant_id": "bilgah-pizza", "shop_id": "6b1e…-shop", "provider": "wolt", "external_order_id": "WOLT-8821", "order_type": "delivery", "items": [ { "product_id": "marg-…", "quantity": 2, "unit_price": 9.90 } ] }
// press “Send request” to call the live sandbox…
# cURL curl -X POST https://d.nextechhq.com/functions/v1/partner-orders \ -H "Authorization: Bearer $TOKEN" \ -H "Content-Type: application/json" \ -d '{"tenant_id":"bilgah-pizza","provider":"wolt","external_order_id":"WOLT-8821","order_type":"delivery","items":[…]}'
Real, auto-granted to the connecthub-demo tenant — the secret is shown once.
whsec_9c…
| Event | Provider | Status | Attempts | Signature | When |
|---|---|---|---|---|---|
| order.status_changed | Wolt | Delivered | 1 | t=…,v1=8f3c… | just now |
| order.status_changed | Bolt Food | Delivered | 1 | t=…,v1=1a09… | 2 min ago |
| stop_list.changed | Wolt | Delivered | 1 | t=…,v1=c910… | 5 min ago |
| order.status_changed | Wolt | Retrying | 3 / 6 | t=…,v1=b27e… | next in 8 min |
| order.status_changed | Booking.com | Dead-letter | 6 / 6 | t=…,v1=44da… | ↻ Replay |
GET /partner-webhooks?tenant_id=…&resource=deliveries (status · attempts · last error). Re-queue a dead or failed one with POST /partner-webhooks {"action":"replay","delivery_id":"…"} — you can only replay your own deliveries. Subscribe to order.status_changed and stop_list.changed.t=<unix>,v1=HMAC‑SHA256(t.payload)
with your endpoint's signing secret. Reject anything that doesn't match — that's how you know it came from DinePro.import crypto from 'node:crypto'; // req.headers['webhook-signature'] = "t=1699…,v1=8f3c…"; raw = the exact request body string function verify(sig, raw, secret) { const p = Object.fromEntries(sig.split(',').map(s => s.split('='))); const expected = crypto.createHmac('sha256', secret).update(`${p.t}.${raw}`).digest('hex'); return crypto.timingSafeEqual(Buffer.from(expected), Buffer.from(p.v1)); }
import hmac, hashlib # sig = request.headers["Webhook-Signature"]; raw = request.body (bytes/str, exact) def verify(sig, raw, secret): p = dict(kv.split("=") for kv in sig.split(",")) expected = hmac.new(secret.encode(), f"{p['t']}.{raw}".encode(), hashlib.sha256).hexdigest() return hmac.compare_digest(expected, p["v1"])
Every authenticated response carries X-RateLimit-Limit · X-RateLimit-Remaining · X-RateLimit-Reset · X-Request-Cost so you always know your budget.
Prefer Postman? Import the collection + sandbox environment — run Get token once and every request is pre-authorized.