OlaClick Public API

Versioned REST API for OlaClick external partners. Use it to read your menu, manage products, and read orders programmatically.

All responses are JSON. All requests must be made over HTTPS.

Base URL

Environment	Base URL
Production	`https://public-api.olaclick.app`

The current API version is v0. Business endpoints are served under the /v1 path prefix (e.g. GET /v1/orders).

Authentication

Every request must be authenticated. There are two options.

1. API key (simplest)

Send your key (it starts with olk_) on every request, using either header:

# Option A — X-API-Key
curl https://public-api.olaclick.app/v1/menu \
  -H "X-API-Key: olk_your_key_here"

# Option B — Authorization: Bearer
curl https://public-api.olaclick.app/v1/menu \
  -H "Authorization: Bearer olk_your_key_here"

API keys are issued per company. If you don't have one yet, request it from your OlaClick contact. Keys are managed under /auth/api-keys (create, list, update, revoke) — see the API Keys section in the reference.

Treat your API key like a password: never commit it to source control or expose it in client-side code. If a key is leaked, revoke it immediately.

Scopes

OAuth access tokens are restricted to the scopes you request. The available scopes are:

Scope	Grants access to
`menu:read`	Read menu, categories and products
`menu:write`	Create / update products
`orders:read`	List and read orders
`clients:read`	Read customer data
`reports:read`	Read reports and analytics
`webhooks:read`	Read webhook subscriptions
`webhooks:write`	Create/update/delete webhook subscriptions
`companies:read`	Read company information

API keys are granted scopes when they are created.

Rate limiting

Requests are rate limited per credential. If you exceed the limit you'll receive 429 Too Many Requests — back off and retry after a short delay. Build clients to handle 429 responses gracefully rather than assuming a fixed quota.

Errors

The API uses standard HTTP status codes:

Code	Meaning
`200` / `201`	Success
`400`	Invalid request (bad parameters or body)
`401`	Missing or invalid credentials
`403`	Authenticated, but missing the required scope
`404`	Resource not found
`429`	Rate limit exceeded
`5xx`	Server error — safe to retry idempotent requests

Base URL​

Authentication​

1. API key (simplest)​

Scopes​

Rate limiting​