> ## Documentation Index
> Fetch the complete documentation index at: https://docs.everybite.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Access & Keys

> Understanding API keys and access levels

Menu data is valuable. It represents a restaurant's brand, pricing strategy, and competitive positioning. It also powers limited-time offers, regional variations, and location-specific pricing.

EveryBite's access levels give restaurants complete control over who can access their data, what information they can see, and who can update it. A chain with different menus in the South? Supported. A franchisee who manages their own LTOs? No problem. A parent company that needs visibility across all brands? Built in.

## Why Access Levels Matter

Restaurant ownership structures are complex. A single restaurant, a regional franchise group, and a global brand parent company all have different needs—and different rights to the data.

Consider a parent company like Yum! Brands. They own Taco Bell, KFC, and Pizza Hut. A technology partner building an app for Yum! needs access to all three chains. But a franchisee building a local ordering app should only see their own locations. And a third-party delivery service partnering with one KFC location shouldn't see data from the location across town.

EveryBite's access levels mirror these real-world relationships:

| Level          | Who Uses It                           | What They See              |
| -------------- | ------------------------------------- | -------------------------- |
| **Restaurant** | Single locations, franchisees         | One location's menus       |
| **Chain**      | Restaurant chains, regional groups    | All locations in the chain |
| **Brand**      | Parent companies, enterprise partners | All chains under the brand |

This structure ensures:

* **Chains** maintain consistency while allowing regional variation
* **Parent companies** get portfolio-wide visibility without exposing individual operator data
* **Third-party partners** access only what they've been explicitly granted

## API Keys

Your **API key** is your credential for accessing menu data. Each key is scoped to a specific level in the restaurant hierarchy based on your relationship with the brand.

Authentication is done by setting the `Authorization` header to the raw API key value. The value starts with `pk_`. Do not add a `Bearer` prefix.

```bash theme={null}
# Include your API key in the Authorization header
Authorization: pk_YWJjMTIzLWRlZjQ1Ni03ODkw.x9Kj2mNpQrStUvWxYz
```

<Info>
  If you are testing requests in the docs explorer or directly against `https://api.everybite.com/graphql`, set:

  * Header name: `Authorization`
  * Header value: `pk_YOUR_API_KEY`

  Paste only the raw `pk_...` value into the auth or headers tab.
</Info>

<Info>
  **Postman users:** Do not use the **Authorization tab** with type "Bearer Token" — Postman will prepend `Bearer ` to the value, which will cause authentication to fail.

  Instead, go to the **Headers tab** and add the key manually:

  | Key             | Value             |
  | --------------- | ----------------- |
  | `Authorization` | `pk_YOUR_API_KEY` |

  If your chain API key is restricted to specific origins, also add an `Origin` header with one of the approved values, otherwise the request will be rejected:

  | Key      | Value                              |
  | -------- | ---------------------------------- |
  | `Origin` | `https://your-approved-origin.com` |
</Info>

## Key Types

<Tabs>
  <Tab title="Restaurant Key">
    **For:** Single-location restaurants or franchisees

    **Access:** One restaurant location and its menus

    ```mermaid theme={null}
    %%{init: {'theme': 'base', 'themeVariables': { 'primaryColor': '#2563EB', 'primaryTextColor': '#fff', 'primaryBorderColor': '#1D4ED8', 'lineColor': '#64748b'}}}%%
    flowchart TD
        Key["Restaurant Key"]
        Location["Single Location"]
        Menus["All menus at that location"]

        Key --> Location --> Menus

        classDef key fill:#1D4ED8,stroke:#1e40af,color:#fff,stroke-width:2px
        classDef loc fill:#3B82F6,stroke:#2563EB,color:#fff,stroke-width:1px
        classDef menu fill:#e2e8f0,stroke:#94a3b8,color:#334155,stroke-width:1px

        class Key key
        class Location loc
        class Menus menu
    ```
  </Tab>

  <Tab title="Chain Key">
    **For:** Restaurant chains with multiple locations

    **Access:** All restaurants in the chain and their menus

    ```mermaid theme={null}
    %%{init: {'theme': 'base', 'themeVariables': { 'primaryColor': '#2563EB', 'primaryTextColor': '#fff', 'primaryBorderColor': '#1D4ED8', 'lineColor': '#64748b'}}}%%
    flowchart TD
        Key["Chain Key"]
        Locations["All Locations<br/>(e.g., 50 honeygrow locations)"]
        Menus["All menus<br/>(may include regional variations)"]

        Key --> Locations --> Menus

        classDef key fill:#1D4ED8,stroke:#1e40af,color:#fff,stroke-width:2px
        classDef loc fill:#3B82F6,stroke:#2563EB,color:#fff,stroke-width:1px
        classDef menu fill:#e2e8f0,stroke:#94a3b8,color:#334155,stroke-width:1px

        class Key key
        class Locations loc
        class Menus menu
    ```
  </Tab>

  <Tab title="Brand Key">
    **For:** Parent companies with multiple chains

    **Access:** All chains, all restaurants, all menus

    ```mermaid theme={null}
    %%{init: {'theme': 'base', 'themeVariables': { 'primaryColor': '#2563EB', 'primaryTextColor': '#fff', 'primaryBorderColor': '#1D4ED8', 'lineColor': '#64748b'}}}%%
    flowchart TD
        Key["Brand Key"]
        ChainA["Chain A<br/>(Taco Bell)"]
        ChainB["Chain B<br/>(KFC)"]
        ChainC["Chain C<br/>(Pizza Hut)"]
        LocA["All Taco Bell locations"]
        LocB["All KFC locations"]
        LocC["All Pizza Hut locations"]

        Key --> ChainA & ChainB & ChainC
        ChainA --> LocA
        ChainB --> LocB
        ChainC --> LocC

        classDef key fill:#1D4ED8,stroke:#1e40af,color:#fff,stroke-width:2px
        classDef chain fill:#2563EB,stroke:#1D4ED8,color:#fff,stroke-width:1px
        classDef loc fill:#3B82F6,stroke:#2563EB,color:#fff,stroke-width:1px

        class Key key
        class ChainA,ChainB,ChainC chain
        class LocA,LocB,LocC loc
    ```
  </Tab>
</Tabs>

## Getting Your Key

<Note>
  **Coming Soon** — We're rolling out developer sandbox access. [Contact us](mailto:api-partnerships@everybite.com) to join the early access waitlist.
</Note>

Once approved, you'll receive API credentials through our partner onboarding process. Your key identifies which restaurant brand's menu data your application can access.

<Warning>
  Keep your API key secure. Do not expose it in client-side code or public repositories. Always proxy API requests through your backend.
</Warning>

## Environments

| Environment | Base URL                            | Status         |
| ----------- | ----------------------------------- | -------------- |
| Sandbox     | `https://api.everybite.com/graphql` | Coming soon    |
| Production  | `https://api.everybite.com/graphql` | Partner access |

<Info>
  Sandbox access is rolling out to early partners. [Contact us](mailto:api-partnerships@everybite.com) to join the waitlist.
</Info>

## Session-Based Context

All guest context is bound to the session when you call `startSession`. This includes:

* **Chain & Location** — Which restaurant and location
* **Platform** — Touchpoint: `IOS`, `ANDROID`, `WEB`, `KIOSK`, `POS`, `VOICE`
* **Guest Identity** — Your guest ID or loyalty ID
* **Passport** — EveryBite Passport ID, if they have one

Once the session is created, your runtime API calls only need three headers:

```bash theme={null}
curl -X POST https://api.everybite.com/graphql \
  -H "Authorization: pk_YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -H "X-Session-ID: sess_7f3a9c2e-8b1d-4e5f-a6c0-9d2e8f1a3b5c" \
  -d '{"query": "..."}'
```

### EveryBite Passport

If a guest has an EveryBite Passport, include their `passportId` when starting the session. This loads their saved dietary preferences automatically—no need to pass filters manually.

See the [Quickstart](/docs/quickstart) for complete session and header examples.

## Rate Limits

| Key Type   | Requests/minute | Requests/day |
| ---------- | --------------- | ------------ |
| Restaurant | 60              | 10,000       |
| Chain      | 300             | 100,000      |
| Brand      | 1,000           | Unlimited    |

Rate limit headers are included in every response:

```
X-RateLimit-Limit: 300
X-RateLimit-Remaining: 297
X-RateLimit-Reset: 1703001600
```

## Error Codes

| Code                  | Meaning                                   | Solution                                     |
| --------------------- | ----------------------------------------- | -------------------------------------------- |
| `INVALID_API_KEY`     | Key is malformed or expired               | Check your key, request a new one if expired |
| `UNAUTHORIZED_ACCESS` | Key doesn't have access to requested data | Verify your key's access level               |
| `RATE_LIMITED`        | Too many requests                         | Slow down, implement backoff                 |
| `KEY_REVOKED`         | Key has been revoked                      | Contact support                              |