Skip to content
Sitora Docs

APIs and authentication

Sitora runs three API families on one backend. They share the same schema discipline and the same principle — workflow truth is computed server-side — but each has its own principal type, and only one of them is public.

First-party app API

Section titled “First-party app API”

Used by the Sitora, Sitora Pro, and Sitora Biz apps. These contracts ship inside the apps and are not published for external integration — they can change with any app release.

Console API

Section titled “Console API”

Used by Sitora Console, the internal administration surface. Reserved for Sitora staff. Not published.

Robotics API — the public one

Section titled “Robotics API — the public one”

/api/robotics/v1/ is Sitora’s open surface: certified robot fleet controllers integrate against it directly. It is URL-versioned, additive within v1, and fully documented in the Robotics API section.

  • Auth: Authorization: Bearer sit_rk_<key> — a filial-scoped robot credential issued by the restaurant owner. The credential is a machine principal: it is not a user, has no membership, and can never act in staff workflows.
  • Discovery: the machine-readable contract is served live, without authentication, at GET /api/robotics/v1/openapi.json. The API reference section of this site is generated from that same document.