Beta: the Biskèt Partner API may still change before v1 is final. Sandbox access is by request:partners@bisket.ai.

Authentication and keys

Send your secret key as a bearer token on every call:

GET /v1/me HTTP/1.1
Host: sandbox.api.bisket.ai
Authorization: Bearer bk_test_…

Environments

	Host	Keys
Sandbox	`https://sandbox.api.bisket.ai`	`bk_test_…`
Live	`https://api.bisket.ai`	`bk_live_…`

A key used on the other host answers 401 wrong_environment. The sandbox is a separate environment with synthetic restaurants: nothing you do there reaches a real restaurant.

Keys

Format: bk_live_ or bk_test_, then 44 base62 characters. The first 12 characters (bk_test_Ab12) are the key’s public prefix: Biskèt support may ask for it, never for the rest.
Issued by Biskèt (in this beta, through your Biskèt contact) and shown once. Biskèt stores only a peppered hash: nobody at Biskèt can read your key back.
Scopes. A key carries scopes, and every location-scoped call also needs the restaurant’s grant (see Connect). The effective scopes are the intersection. Missing either gives 403 insufficient_scope.
Expiry. At most one year. You are notified 14 and 3 days before.
Rotation. Ask for a rotation: you get a new key, and the old one keeps working for an overlap window (7 days by default) so you can deploy without downtime. Then the old one expires.
Revocation is immediate: the key answers 401 invalid_api_key.

If a key leaks

Tell Biskèt at once (partners@bisket.ai, with the key’s prefix). We revoke it and issue a new one. Keys belong on your servers only: the SDK refuses to run in a browser.

GET /v1/me returns your account, your settings (timeouts, discount cap, collection modes, payment methods, settlement terms, rate limits) and the calling key’s metadata. Use it as a credentials health check.