API for developers
Third-party apps work with a business's data through the public API — Platform API v1: they read the business profile, catalog, menus, orders and reports and, with the owner's permission, create orders. This article explains where the documentation is, how an app gets access and who controls it.
Terms
Commercial use of the API is covered by an individual agreement or separately agreed terms. If you plan an integration, write to this chat — a specialist will explain the terms and register your app.
Documentation
The documentation is public — no sign-in and no key needed:
| What | Paloma365 | PalomaPOS |
|---|---|---|
| Documentation for people | https://alfaposapi.paloma365.com/platform/v1/docs | https://alfaposapi.palomapos.com/platform/v1/docs |
| Integration guide (Markdown) | https://alfaposapi.paloma365.com/platform/v1/guide.md | https://alfaposapi.palomapos.com/platform/v1/guide.md |
| OpenAPI description | https://alfaposapi.paloma365.com/platform/v1/openapi.json | https://alfaposapi.palomapos.com/platform/v1/openapi.json |
| Entry point for AI tools | https://alfaposapi.paloma365.com/platform/llms.txt | https://alfaposapi.palomapos.com/platform/llms.txt |
If an AI coding assistant builds the integration, give it the llms.txt link — it links to everything else.
The API is switched on per market. Until it is on, the documentation is already public and data requests answer 404.
How an app gets access
- App registration. The developer writes to this chat; we register the app and issue its identifier and secret. If the integration is only for your own business, no registration is needed — see Personal integration: a key from the dashboard.
- Owner consent. The app opens a consent screen on our server. The account owner sees which app asks for access and what it will be able to do, and presses Allow. Employees and support specialists cannot give consent.
- Work. The app gets access only to that account's data and only within what the owner agreed to. Access granted by one account does not open another account's data: each venue gives consent separately.
Personal integration: a key from the dashboard
The account owner can create a key for their own scripts and services — no developer registration and no consent screen: Connected apps → Create integration.
It is the same Platform API v1: the same URLs, the same scopes and the same Authorization: Bearer header. Only the source of the token differs:
- the key (it starts with
ppik_) is shown to the owner once, when it is created; - it opens only this account's data and only within the selected permissions;
- it does not expire — it works until the owner deletes the integration on the same page;
- it doesn't need refreshing the way an app's token does.
One request checks the key (for PalomaPOS, use alfaposapi.palomapos.com):
curl https://alfaposapi.paloma365.com/platform/v1/me -H "Authorization: Bearer <key>"Keep the key like a password. If it may have leaked, delete the integration and create a new one.
Viewing and revoking access
All connected apps and personal integrations are listed in Connected apps: what each can do and when it last used its access. The owner revokes access or deletes an integration there — access ends immediately.
Related topics
- Ready-made integrations (delivery, marketplaces, Telegram, Bitrix24) are switched on without programming: Integrations.
- MCP connector — a separate way to connect an AI assistant to account data: MCP connector.