Core concepts
Authentication.
Pass your key on every request as a bearer token:
BASH
curl https://api.tabsettle.com/v1/locations \ -H "Authorization: Bearer ts_live_XXXXXXXXXXXXXXXXXXXXXXXX"
Scopes.
| Scope | Grants |
|---|---|
| read | All GET endpoints. |
| write | Check ingestion, close/void, and webhook-endpoint management. |
Key handling.
Your key is shown exactly once when issued. TabSettle stores only a hash — if a key is lost, a new one is issued.
Rotation.
- Request a second key.
- Switch your integration over to it.
- Have the first key revoked.
Two active keys per restaurant is normal. Revocation takes effect on the next request.