Getting started
A partner path from first read to production review. Production credentials are never issued automatically.
- Create a developer account at restrosync.com/developers — name, email, company (organization), password. Extra marketing fields are not part of this API.
- Verify email then sign in at
app.restrosync.com/developers. Partner verification may gate sandbox until HQ activates the org. - Create an application (type: pos, restaurant_platform, loyalty_platform, analytics, or other).
- Copy sandbox secrets once — API secret (inbound HMAC) and webhook secret (outbound). They are never shown again.
- Select X9 scopes. Capabilities and health are HMAC discovery, not grantable scopes.
- Call GET capabilities / health with a signed empty body.
- Send the first customer — console Try It uses the mock guest; OpenAPI/Postman examples use Asha Khan
+910000000099. - Send the first bill — ₹1,480 Chicken Tikka / Beer / Fries fixture (
bill_1480). - Subscribe a webhook (
test://successin TEST) and trigger a sandbox event. - Inspect logs and deliveries in the application workspace. Secrets never appear there.
- Request production access. Status becomes pending review. HQ mints new production credentials on approve — sandbox secrets are never promoted.
Inbound HMAC uses the API secret. Outbound partner webhooks use the webhook secret. Sign timestamp + "." + rawBody. Replay window 5 minutes.