Quickstart

1. Get credentials

Request a sandbox client ID and client secret by emailing support@chompypos.com. Include your company name and a short description of your integration. The credentials need the checks:read scope.

Authentication uses the OAuth client credentials grant. Each pair grants server-to-server access to approved locations, without a restaurant login redirect or per-location API key.

Keep your client secret in your server’s secret storage. Never put it in browser code, mobile applications, URLs, source control, or shared logs.

2. Get an access token

The examples require Bash or Zsh, curl, and jq. Load your credentials into CHOMPY_CLIENT_ID and CHOMPY_CLIENT_SECRET using your secret manager or local environment, then set the sandbox base URL:

export CHOMPY_API_BASE_URL='https://sandbox-integrations.chompypos.com'

Use HTTP Basic authentication with the client ID as the username and the secret as the password. Send a form-encoded body, not JSON. This stores the token without printing it:

chompy_token_response="$(
  curl --fail-with-body --silent --show-error --max-time 20 \
    --user "${CHOMPY_CLIENT_ID:?Load your client ID}:${CHOMPY_CLIENT_SECRET:?Load your client secret}" \
    --data 'grant_type=client_credentials' \
    "$CHOMPY_API_BASE_URL/oauth/token"
)" &&
CHOMPY_ACCESS_TOKEN="$(printf '%s' "$chompy_token_response" | jq -er '.access_token')" &&
export CHOMPY_ACCESS_TOKEN

A successful response (token redacted):

{
  "access_token": "YOUR_ACCESS_TOKEN",
  "token_type": "Bearer",
  "expires_in": 900,
  "scope": "checks:read"
}

Tokens last 15 minutes by default; use the response’s expires_in value. Reuse the token across requests and obtain a new one before it expires. There is no refresh token. If authentication fails, check that the client ID and secret belong to the same pair and environment.

3. List locations

curl --fail-with-body --silent --show-error --max-time 20 \
  --header "Authorization: Bearer ${CHOMPY_ACCESS_TOKEN:?Get an access token first}" \
  "$CHOMPY_API_BASE_URL/v1/locations" | jq

The response includes only locations your credentials can access:

{
  "locations": [
    {
      "id": "sandbox-downtown",
      "name": "Downtown Sandbox",
      "timezone": "America/New_York"
    },
    {
      "id": "sandbox-uptown",
      "name": "Uptown Sandbox",
      "timezone": "America/New_York"
    }
  ]
}

4. Read checks

Choose a returned location. This starting date includes all available sandbox checks:

export CHOMPY_LOCATION_ID='sandbox-downtown'

chompy_checks_page="$(
  curl --fail-with-body --silent --show-error --max-time 20 --get \
    --header "Authorization: Bearer ${CHOMPY_ACCESS_TOKEN:?Get an access token first}" \
    --data-urlencode 'updated_since=2000-01-01T00:00:00Z' \
    --data-urlencode 'limit=1' \
    "$CHOMPY_API_BASE_URL/v1/locations/$CHOMPY_LOCATION_ID/checks"
)" &&
printf '%s' "$chompy_checks_page" | jq

The response contains complete check snapshots in checks, plus has_more and next_cursor. Save next_cursor after processing the page, even when has_more is false.

See Syncing checks for pagination and polling, and the API reference for response fields.

Production

Request production credentials from Chompy. Use them to get a token at https://integrations.chompypos.com, list authorized locations, and start a fresh sync for each location.

Sandbox and production use the same endpoints and response shapes, but their credentials, tokens, locations, and cursors are separate. Don’t reuse sandbox sync state in production.