API Access

Accessing the GrubStack API

Every GrubStack subscription includes API access. There are two ways to authenticate against the API, depending on what you're building.

Dashboard sessions (JWT)

When you sign in to our GrubStack website, your browser receives a short-lived JWT session token. This is how the GrubStack Core dashboard itself talks to the API, and it's scoped to your specific user account and permissions.

Logging in via cURL or Postman

You can obtain a JWT directly by sending your username and password to the login endpoint. This URL is the same for every customer:

https://api.grubstack.app/v1/auth

The request body must be a raw JSON object containing your username and password.

cURL

curl -X POST https://api.grubstack.app/v1/auth \
  -H "Content-Type: application/json" \
  -d '{"username": "you@example.com", "password": "your-password"}'

Postman

1. Create a new request and set the method to POST.
2. Set the URL to https://api.grubstack.app/v1/auth.
3. Open the Body tab, select raw, and choose JSON from the format dropdown.
4. Enter your credentials:

{
  "username": "you@example.com",
  "password": "your-password"
}

5. Send the request. On success, the response body's data.access_token field contains your JWT.

Use that token on subsequent requests with an Authorization: Bearer <access_token> header.

Direct API access (access token)

If you're integrating GrubStack into another system — a POS, a reporting tool, or a custom application — GrubStack issues your tenant a dedicated access token during onboarding. Contact your account team if you need one issued or rotated.

Send it as an HTTP Basic Authorization header on any request:

Authorization: Basic <your-access-token>

The value after Basic is your raw access token — it is not base64-encoded the way traditional HTTP Basic credentials are.

Direct access tokens are currently scoped to read-only endpoints (locations, menus, items, and franchise data). If your integration needs to write data — creating orders, updating menus — build against a user-authenticated session instead.

Base URL

Your API is available at:

https://api-<your-slug>.grubstack.app/v1

Example request

curl https://api-<your-slug>.grubstack.app/v1/locations \
  -H "Authorization: Basic <your-access-token>"