Request access

The Admin API is private. Each organization that uses Canteen can ask for a token and read its own orders, products and establishments. There is no self-service signup: we hand out tokens after a short exchange, so we know who is calling and can size the limits properly.

What you receive

Item	Purpose
Access token	Sent as a bearer token in the Authorization header of every request.
Organization UUID	Sent in the X-CANTEEN-ORGANIZATION header. It tells the API which organization the request is for.

Tokens are tied to a user of your organization. Anything that user can see in the backoffice, the token can read through the API.

How to ask

Use the contact form and include:

• the name of the organization as it appears in the Canteen backoffice
• what you plan to build, in a couple of sentences
• roughly how often you expect to call the API

You normally hear back within one business day. If the integration needs any of the endpoints marked as Restricted in the sidebar, mention them in the message.

Keeping the token safe

• Store it in a secret manager or environment variable, never in a repository.
• Do not ship it in a browser or mobile app. The Admin API is meant for server to server calls.
• If it leaks, tell us and we revoke it immediately and issue a new one.