Authentication

Every request carries a secret API key:

Authorization: Bearer gok_live_xxxxxxxxxxxxxxxxxxxxxxxx

X-API-Key: gok_live_… is also accepted if your HTTP client makes Authorization awkward.

Key format

Prefix	Environment	What it does
gok_test_	Sandbox	Reads real menus; orders are simulated and never reach a restaurant
gok_live_	Live	Places real orders that restaurants prepare and riders deliver

The environment is decided by the key — there is a single base URL. A sandbox order is invisible to a live key and vice versa.

Scopes

Each key carries only the permissions it needs.

Scope	Allows
catalog:read	Stores, menus, items, search, delivery quotes, categories
offers:read	Offers and promo-code validation
orders:read	Read and track orders
orders:write	Create, pay for and cancel orders (and drive the sandbox)
webhooks:manage	Configure the webhook endpoint, read and retry deliveries

A request outside the key’s scopes fails with 403 insufficient_scope, and the error tells you which scope was required.

Keep keys safe

Caution

A key is a password for your account. Anyone who has it can place orders as you.

• Store keys in a secret manager or environment variables — never in source control, a browser or a mobile app.
• Use a separate key per system (production server, staging, a contractor) so one can be revoked without breaking the others.
• GoOrder stores only a hash of each key. We cannot show it again — if you lose a key, ask us to issue a new one and revoke the old one.
• Rotate on a schedule and whenever someone with access leaves.

Rotating without downtime

1. Ask your GoOrder contact to issue a second key with the same scopes.
2. Deploy the new key to your servers.
3. Confirm traffic on the new key, then ask us to revoke the old one.

Both keys work at the same time until you do.

Authentication errors

Status	error.code	Meaning
401	missing_api_key	No key was sent
401	invalid_api_key	The key is wrong, expired or revoked, or your account is suspended
403	insufficient_scope	The key lacks the scope this endpoint needs
403	sandbox_only	You called a sandbox-only endpoint with a live key

See Errors for the full format.