Erste Schritte mit der Conciar API

Two APIs

1. Create an API key

1. Sign in to my.conciar.com as an admin or manager.
2. Open Management → API Keys and choose New API Key.
3. Give it a name. You get a pair: a publishable key (pk_…) and a secret key (cnct_…).
4. Copy both straight away: they are shown once. Conciar only stores a hash, so a lost key can't be shown again; create a new one.

Revoking or deleting either half of a pair revokes or deletes both. Keys belong to your organization and work with any of its active sales channels.

The Connect API sends no CORS headers, so browsers block calls from JavaScript on another domain. Call it from a server or a native app.

2. Pick a sales channel

Each location or shop you sell through is a sales channel. Its channel token (cnct_ch_…) goes in the X-Sales-Channel header of every /store call; it decides the menu or catalogue, prices, currency, language and payment methods.

Find it in my.conciar under Settings → Sales channels (“Channel token”), or let your app call GET /locations, which lists every active channel with its sales_channel_token.

Connect request headers

3. Make a first request

List your locations with the publishable key. Everything in these examples is made up; use your own key.

curl "https://api.conciar.com/connect/v1/locations" \
  -H "Accept: application/json" \
  -H "X-Api-Key: pk_your_publishable_key"

{
  "data": {
    "timezone": "Europe/Amsterdam",
    "locations": [
      {
        "sales_channel_token": "cnct_ch_your_channel_token",
        "name": "Bistro Example",
        "is_test": false,
        "address": "Example Street 1, 1000 AA Example City",
        "is_open_now": true,
        "…": "…"
      }
    ]
  }
}

Then follow a whole flow in the code examples, or look up any endpoint in the API reference.

Signed-in customers

Customers sign in with a 6-digit code sent by email (POST /auth/otp/request, then POST /auth/otp/verify). Verifying returns an access_token, valid for 6 months.

Send it as Authorization: Bearer … next to the API key. The /store/customer endpoints need it; on restaurant orders it is optional and turns a guest order into a member order that earns stamps and points.

Errors

Errors are JSON. Check the HTTP status first. The body has a message; many Connect errors also have "status": false and a code such as ITEM_UNAVAILABLE in message, with errors keyed by field. The public booking API answers {"status": false, "code": "…"}.

Rate limits

• Connect API: 300 requests per minute per IP address overall. Some endpoints have their own, lower limit, shown in the reference. Most of those count per key, and for a publishable key per key and IP address, so one busy app doesn't use up the limit for everyone.
• Restaurant orders also have a per-store limit (60 new orders and 120 payment or cancel calls per minute by default), whichever key or IP calls.
• Sign-in codes: 5 requests per minute per IP, and at most one code per minute and five per hour for the same address (429 OTP_COOLDOWN with retry_after).
• Public booking API: per restaurant and IP address, 120 reads and 10 bookings or other changes per minute; gift cards 60 reads and 6 purchases per minute.

Over the limit you get 429 {"message": "Too Many Attempts."} with a Retry-After header. Responses carry X-RateLimit-Limit and X-RateLimit-Remaining.

No code: the booking widget

To take reservations on a website without building anything, embed the Conciar booking widget. It uses the public booking API. Replace the guid with your restaurant's.

<div class="conciar-widget"
     data-widget-type="restaurant-reservation"
     data-guid="YOUR_RESTAURANT_GUID"
     data-lang="auto"></div>
<script src="https://widget.conciar.com/conciar-widget.iife.js" defer></script>

data-lang is a language code such as en or nl, or auto for the visitor's browser language.