API Keys

API keys grant access to one restaurant. Restaurant scope is bound when key is created and cannot be selected or changed by API clients.

Create a Key

1. Sign in as an enyDyne administrator or restaurant waiter.
2. Open restaurant admin dashboard.
3. Find API keys and select Create API key.
4. Copy generated key immediately.

New key is masked by default. Reveal shows it temporarily and Copy writes it to clipboard.

Plaintext key is returned only once. enyDyne stores only a cryptographic digest, so key cannot be recovered after page reload. Create a replacement if key is lost.

Send a Key

Use bearer authentication:

Authorization: Bearer eny_00000000-0000-0000-0000-000000000000_example

Never put keys in URLs, GraphQL variables, browser code, source control, logs, or screenshots.

Revoke a Key

Select Delete beside key in restaurant dashboard. Revocation takes effect immediately. Requests using deleted key receive 401 Unauthorized.

Deleting restaurant also revokes all keys connected to it.

Storage

Treat key like password:

• Store it in secret manager or protected environment variable.
• Restrict access to receipt-printing service.
• Use separate keys for separate integrations so each can be revoked independently.
• Rotate keys by creating replacement, updating integration, then deleting old key.