Authentication

Every request sends an API key in the api_key query parameter:

Terminal

curl "https://pos.pages.fm/api/v1/shops/SHOP_ID/orders?api_key=API_KEY"

Two kinds of API key

	Shop API key	Account API key
Created in	Settings › Apps › Webhook/API, API Key tab	Account › API Key
Works for	One shop	Every shop the account belongs to
Permissions	Full Open API access to the shop	The account's own permissions in each shop: role, warehouses, department, work hours, allowed IPs
Key format	Random string	Starts with `pos_user_`
Best for	Background integrations between two systems (ERP, website)	Tools acting on behalf of one person: personal scripts, MCP

Both kinds call the same endpoints. An account key is rejected (403) for actions the account is not allowed to do.

Open Settings › Apps and choose Webhook/API.
Open the API Key tab and click Add. Note what the key is for so it is easy to manage.
Copy the key and store it somewhere safe on your server.

Delete a key in the same list when you no longer need it; systems using it are rejected immediately.

One key works for every shop you belong to:

Call GET /shops to see which shops the key can access; every other endpoint needs {SHOP_ID} in the path.
Leaving a shop or having your permissions changed takes effect on the key immediately.
Rename or revoke the key in the same list. An API key cannot create or revoke other API keys.

An API key is as powerful as a password: never ship it in browser or mobile app code, never commit it to git, never send it in chat.
Call the Open API from your server and read the key from an environment variable or a secret store.
If a key may have leaked, delete or revoke it at once and create a new one.
20 wrong api_key attempts within a minute from the same IP address lock that address for 5 minutes (429, code 109, with a Retry-After header).

Apps running inside POS do not use API keys: POS issues an app token for the person using the app. See POS Apps › Data access.