Authentication
Because your POS is the server here, you define the authentication scheme and Cheers adapts to it. There is no mandatory scheme.
Accepted Schemes
All of the following are in production use today:
| Scheme | Example | Notes |
|---|---|---|
| API key in a custom header | X-API-KEY: YOUR_KEY | The most common choice. The header name is yours -- any name works. |
Authorization header, token | Authorization: Bearer YOUR_TOKEN | Also accepted without the Bearer prefix if that is what your API expects. |
Authorization header, Basic auth | Authorization: Basic base64(user:password) | The partner enters the username and password; Cheers builds the header. |
| Key in the request body | { "apiKey": "YOUR_KEY", ... } | Used with POST-based endpoints. |
Cheers stores the credentials the partner enters and sends them with every request. There is no token-exchange or refresh step -- if your API issues short-lived tokens, provide a long-lived key for the sync instead.
What the Partner Must Provide
The partner enters these values in the Cheers CMS when setting up the integration. List them in your own onboarding material so the partner knows what to ask you for:
| Value | Required | Description |
|---|---|---|
| Base URL | If it differs per partner | The host (and path prefix) of your API, e.g. https://pos.example.com/api. If every partner shares one URL, Cheers can hard-code it in the adapter instead. |
| Credentials | Yes | Whatever your scheme needs: API key, token, or username + password. |
| Scoping identifier | If applicable | A business unit / restaurant / venue / price list identifier, needed when one credential serves several units and the sync must be narrowed to one of them. |
Cheers configures the sync per venue. If a single API key covers multiple venues, you must offer some way to select one -- a path parameter, a query parameter or a body field -- and tell the partner which value identifies their venue.
Errors
Reject bad credentials with 401 Unauthorized. See Requirements for why an
error must never be returned inside a 200 OK response.