Authentication Overview

​

Authentication Flow

1. Register - Create a new organization and user account
2. Login - Authenticate with email and password to receive tokens
3. Use Access Token - Include the access token in the Authorization header for API requests
4. Refresh - Use the refresh token to obtain a new access token when it expires

​

Token Types

​

Access Token

• Short-lived token used to authenticate API requests
• Include in the Authorization header as Bearer {accessToken}
• Contains user ID, organization ID, role, and branch access

​

Refresh Token

• Long-lived token (7 days) used to obtain new access tokens
• Store securely on the client
• Can be revoked by logging out

​

Making Authenticated Requests

curl https://api.restai.com/api/endpoint \
  -H "Authorization: Bearer YOUR_ACCESS_TOKEN"

​

User Roles

• org_admin - Full access to all organization resources
• branch_manager - Manage specific branches
• cashier - Process payments and orders
• waiter - Take and manage orders
• kitchen - View and update order preparation status

​

Error Codes

• 401 UNAUTHORIZED - Invalid credentials or expired token
• 409 CONFLICT - Email or organization slug already exists
• 404 NOT_FOUND - User not found

​

Base URL

https://api.restai.com/api/auth