Quickstart

This page walks you through going from zero to your first successful call against the RestroLab’s API.

There are two roles in this flow, and it’s important not to mix them up:

• The organization owner (the restaurant/hotel) generates a credential inside RestroLab and hands it to you, once. They authenticate to RestroLab with their own login; you never see that.
• Your platform (the integrator) uses that credential on every call described on this site. Your platform never logs into RestroLab directly.

1. Get API credentials from the tenant owner

Credentials are created by the tenant owner, not by you. The owner:

1. Logs into RestroLab and calls POST /v1/third-party/credentials/ (authenticated with their own RestroLab login; a JWT bearer token; see Authentication).
2. Receives an api_key and api_secret in the response, shown exactly once.
3. Pastes those two values into your platform’s own settings/integration page.

Your platform never calls /v1/third-party/credentials/* itself,that’s owner-only. From here on, your platform only calls the partner-facing endpoints below using the api_key / api_secret the owner gave you.

2. Configure your credentials securely

Store the credential your platform received as environment variables.Never hardcode it or commit it to version control.

# .env (never commit this file)
RESTROLAB_API_KEY=the_api_key_the_owner_gave_you
RESTROLAB_API_SECRET=the_api_secret_the_owner_gave_you

cURL

export RESTROLAB_API_KEY="the_api_key_the_owner_gave_you"
export RESTROLAB_API_SECRET="the_api_secret_the_owner_gave_you"

JavaScript

const apiKey = process.env.RESTROLAB_API_KEY;
const apiSecret = process.env.RESTROLAB_API_SECRET;

Python

import os

api_key = os.environ["RESTROLAB_API_KEY"]
api_secret = os.environ["RESTROLAB_API_SECRET"]

3. Make your first API request

List the organization’s menu. The orgnization is resolved entirely from your credential, you never send a tenant_id, restaurant_id, or hotel_id.

cURL

curl https://api.restrolab.com/v1/third-party/menu/ \
  -H "X-API-Key: $RESTROLAB_API_KEY" \
  -H "X-API-Secret: $RESTROLAB_API_SECRET"

JavaScript

const response = await fetch('https://api.restrolab.com/v1/third-party/menu/', {
  headers: {
    'X-API-Key': apiKey,
    'X-API-Secret': apiSecret,
  },
});

const dishes = await response.json();
console.log(dishes);

Python

import requests

response = requests.get(
    "https://api.restrolab.com/v1/third-party/menu/",
    headers={"X-API-Key": api_key, "X-API-Secret": api_secret},
)
response.raise_for_status()
print(response.json())

Note

api.restrolab.com is a placeholder for RestroLab’s real API host — there’s one shared host for every organizatiopn; your credential determines which tenant a request resolves to, not the URL. See API Overview.

4. Understand the response

GET /v1/third-party/menu/ returns a plain JSON array of dishes (this API does not paginate list responses, see Pagination). Each dish’s sku is what you echo back as item_id when placing an order:

[
  {
    "id": "b3f1e2c0-9d3e-4a2b-8f1a-1234567890ab",
    "name": "Margherita Pizza",
    "sku": "PIZZA-MARG-01",
    "price": "9.99",
    "currency": "USD",
    "is_active": true
  }
]

See Your First Request for the full field list.

5. Continue to the API Reference

Once your first request works, browse the full, interactive API Reference, generated directly from openapi.json , to see every endpoint (Restro menu and orders, Hotel rooms, availability and reservations, and webhooks), parameter, and schema.