# Fiest Partner API

Source: https://docs.fiest.io/api

The Fiest Partner API gives approved integrations scoped, read-only access to
the restaurants a Fiest owner or administrator explicitly authorizes.

<Callout type="info" title="Partner access is reviewed">
  API clients are registered by Fiest. The public reference documents the
  contract, but it does not enable self-service production access or expose
  capabilities that are still in private review.
</Callout>

<Callout type="info" title="Sandbox preview is available">
  Approved partners can integrate against an isolated sandbox today.
  Production access uses a separate client registration and is enabled only
  after Fiest approves the integration. A documented operation may also be
  disabled in an environment until Fiest approves and enables that capability
  for the client.
</Callout>

## How access works [#how-access-works]

1. Contact Fiest to register the integration and its exact redirect URIs.
2. Redirect the Fiest owner or administrator through OAuth 2.1 authorization
   code with PKCE `S256`.
3. Request the mandatory baseline scopes `fiest.restaurant.read` and
   `fiest.accounting.read`.
4. Send the audience-bound access token to the API resource registered for
   the connection.
5. Treat access tokens as one-hour credentials while honoring `expires_in`.
   Keep longer-lived connections with a rotating 90-day refresh token. Every
   successful refresh replaces the previous refresh token, which cannot be
   replayed.

Tokens are bound to the Partner API audience and cannot be reused with the
Fiest MCP server. Restaurant access is resolved from the current authorization
grant on every request. These lifetimes are maximums, not a promise that a
token remains valid: revocation, membership changes, or an invalid grant can
end access earlier and require a new authorization.

For a Management organization authorization, also request
`fiest.organization.read`. Request `offline_access` only when the integration
needs to stay connected after the current access token expires.

## Available capabilities [#available-capabilities]

<Cards>
  <Card title="Quick start" href="/api/quickstart">
    Configure OAuth, implement the callback, and give an AI coding agent the reviewed setup prompt.
  </Card>

  <Card title="Authorized restaurants" href="/api/reference/list-restaurants">
    Discover only the restaurants included in the reviewed grant.
  </Card>

  <Card title="Restaurant profile" href="/api/reference/get-restaurant">
    Read general restaurant and operational context.
  </Card>

  <Card title="Accounting summary" href="/api/reference/get-accounting-summary">
    Retrieve a reconciliation-aware summary for a date range.
  </Card>
</Cards>

Looking for ChatGPT, Claude, Claude Code, or Codex? Open the
[Fiest MCP setup guide](/mcp) instead. MCP connections use a separate server,
authorization audience, and setup flow from Partner API integrations.

## Environments [#environments]

Partners only need to choose between the sandbox and production. Fiest's
internal development and staging environments are not part of the public
integration surface.

| Environment | Status                         | API resource                   | OAuth issuer                    |
| ----------- | ------------------------------ | ------------------------------ | ------------------------------- |
| Sandbox     | Available to approved partners | `https://api-sandbox.fiest.io` | `https://auth-sandbox.fiest.io` |
| Production  | Available to approved partners | `https://api.fiest.io`         | `https://auth.fiest.io`         |

Sandbox and production clients are registered separately, and their redirect
URIs, issuers, audiences, tokens, and credentials must never be mixed.

## Interactive requests [#interactive-requests]

The first public reference release provides schemas and generated request
examples without accepting credentials in this site. Fiest maintains a
local-only API Lab for partner acceptance testing. A partner-authenticated
hosted “Try it” experience may be added later after a separate security review.