Authentication

Every call to the API carries the connection's key:

Authorization: Bearer pk_<connectionId>.<keyId>.<secret>

• Treat the key as one opaque string and keep it secret. For reference: connectionId is pc_ plus 20 lowercase hex characters, keyId is 16–32 lowercase letters or digits, and secret is 16–128 characters of [A-Za-z0-9_-].
• A key can only see and change its own connection. Another connection's order answers 404.
• 401 UNAUTHORIZED: the key is missing, malformed, unknown, wrong, expired or revoked.
• 403 CONNECTION_REVOKED: the key is right, but the restaurant deleted the connection. Stop sending. To resume, the restaurant must create a new connection, which comes with a new key.
• Key rotation is done by the restaurant in its till. The previous key keeps working for 24 hours, so you have time to switch. At most two keys are valid at any time.