Authentication

Partner calls to /v1/integrations/:id/… use HMAC, not restaurant login.

X-ROS-Signature: sha256=<hex>
X-ROS-Timestamp: <unix seconds>
X-ROS-Event-Id: <id>
X-ROS-Key-Id: <key id>

Canonical string: timestamp + "." + rawBody. Replay window is 5 minutes. Rate limit is 30 requests / 60 seconds per connection.

Developer Console uses a developer session (rsdev_* in TEST, or Firebase with rs_aud=developer). That token cannot call restaurant GET /v1/me.