Authentication | Unipage Developers

Every Core API call carries the restaurant’s Core API key.

The key

A Core API key looks like this:

upg_capi_<business id>_<8 characters>.<secret part>

The part before the dot identifies the key. The part after it is the secret; Unipage only stores a hash of it, so a lost key cannot be shown again. The restaurant creates a new one instead.
The key belongs to one restaurant (one location). Use it only on that location’s URL: https://api.unipage.eu/{business id}/.... On another location’s URL it is refused with a 401.
It has full access to that location. Keep it on your server, in a secret store or environment variable, never in a browser bundle, an app or a repository.

Sending the key

Send it in the X-API-Key header:

curl https://api.unipage.eu/x94d3/customers \
  -H "X-API-Key: $UNIPAGE_CORE_API_KEY"

const res = await fetch("https://api.unipage.eu/x94d3/customers", {
  headers: { "X-API-Key": process.env.UNIPAGE_CORE_API_KEY },
});
const { data } = await res.json();

$response = Http::withHeaders([
    'X-API-Key' => env('UNIPAGE_CORE_API_KEY'),
])->get('https://api.unipage.eu/x94d3/customers');

Revoking a key

The restaurant deletes the key on the same settings card. From that moment every call with it is refused with a 401. A key can also be switched off temporarily, which answers 403 until it is switched on again. See Errors and limits for the exact responses.