Getting started

This walkthrough takes you from no account to a successful API call. Everything happens in the developer console except the last step, which you run from your own backend.

Before you begin

You need a work email address you control and a backend that can keep a secret. Client secrets and webhook secrets must never ship in a POS terminal build, a mobile app or browser code.

1. Create a developer account

   Sign up at the console with your name, work email and a password. Quiqqy emails you a verification link; the account cannot sign in until you open it.

   Developer accounts are separate from merchant accounts. Using the same email for both is fine — they are different identities in different systems.

2. Apply for API access

   Signing in for the first time drops you on the developer application. Tell us who you are and what you intend to build: company name, country, website, a paragraph on the use case, and which products you need — Online Ordering, Hub Ordering, Mercnet Reports, or any combination.

   A Quiqqy reviewer approves or declines, and you are emailed either way. Applications are usually answered within two business days.

3. Sign the developer agreement

   Once approved, the console shows the current developer agreement. Read it, tick the acknowledgement box and sign with your full name. The signature is recorded against your account and the agreement version, and the rest of the console unlocks. If a newer agreement version is published later, the console asks you to sign again before you can make further changes.

4. Create an app in the console

   In Apps → New app, give the app a name and a one-line description. The app is the unit everything else hangs off: credentials, webhooks, store integrations, usage logs and — when you get there — the go-live review.

5. Get credentials

   Open the app’s Credentials tab and create a client credential. You get a client_id and a client_secret:

   Shown once — copy it now

   client_id      app_7pk2mv9qx4rt
   client_secret  qk_live_5zkq5vj2rn8pxw3tfm6bd1yh4sc7ae0g

   The secret is hashed the moment it is stored; there is no endpoint that reads it back. If you lose it, rotate the credential and use the new one. While the credential is there, also register at least one Allowed Redirect URI — the OAuth flow in the next step refuses redirect targets that are not on the list.

6. Point at the base URL

   Your credentials work immediately, against the one base URL for your product (https://auth.quiqqy.ai/api/v2 for Online Ordering — see the overview). There is no sandbox host and no separate test credential: your app is a draft until you publish it, but the flow is already the production one.

   Because of that, everything you touch is real. Onboard a store you own and use an email address on your own domain — see Testing your integration.

7. Make your first call

   The first real call in any Online Ordering integration is POST /pos/signup_url: it provisions a merchant and store and returns the consent URL the merchant visits to authorize your app. It authenticates with your client credentials over HTTP Basic — no token needed yet.

   The account it creates is real and gets emailed, so while you are developing, send an address on your own domain.

   curl

   curl -s https://auth.quiqqy.ai/api/v2/pos/signup_url \
     -u "app_7pk2mv9qx4rt:qk_live_5zkq5vj2rn8pxw3tfm6bd1yh4sc7ae0g" \
     -H 'Content-Type: application/json' \
     -d '{
       "location_id": "LOC-001",
       "store_name": "Main Street Pizza",
       "email": "owner@mainstreetpizza.example",
       "redirect_uri": "https://pos.example.com/quiqqy/callback"
     }'

   Node

   const credentials = Buffer.from(
     `${process.env.QUIQQY_CLIENT_ID}:${process.env.QUIQQY_CLIENT_SECRET}`,
   ).toString('base64');
   
   const response = await fetch('https://auth.quiqqy.ai/api/v2/pos/signup_url', {
     method: 'POST',
     headers: {
       Authorization: `Basic ${credentials}`,
       'Content-Type': 'application/json',
     },
     body: JSON.stringify({
       location_id: 'LOC-001',
       store_name: 'Main Street Pizza',
       email: 'owner@mainstreetpizza.example',
       redirect_uri: 'https://pos.example.com/quiqqy/callback',
     }),
   });
   
   const { signup_url } = await response.json();

   Python

   import os
   import requests
   
   response = requests.post(
       "https://auth.quiqqy.ai/api/v2/pos/signup_url",
       auth=(os.environ["QUIQQY_CLIENT_ID"], os.environ["QUIQQY_CLIENT_SECRET"]),
       json={
           "location_id": "LOC-001",
           "store_name": "Main Street Pizza",
           "email": "owner@mainstreetpizza.example",
           "redirect_uri": "https://pos.example.com/quiqqy/callback",
       },
   )
   response.raise_for_status()
   signup_url = response.json()["signup_url"]

   200 OK

   {
     "status": "success",
     "signup_url": "https://auth.quiqqy.ai/api/v2/oauth2/authorize?client_id=app_7pk2mv9qx4rt&redirect_uri=…&email=…"
   }

   A signup_url in the response means your credentials and redirect URI line up. Open that URL yourself and play the merchant through consent — the full flow is in Store onboarding.

Keep the redirect URI consistent

The redirect_uri you send here must exactly match one of the Allowed Redirect URIs on your credential, and the same value must be repeated on the token exchange. Mismatches are the most common first-day failure.

What to do next

• Authentication — the OAuth flow behind signup_url, token lifetimes and caching.
• Your product guide: Online Ordering, Hub Ordering or Mercnet Reports.
• Webhooks — set up and verify your endpoint before you take a first order.
• Go-live checklist — what production review asks for.