ekx-toast-poslisted

# Toast POS Our **physical market channel**. One of three channels reconciled into a single Supabase source of truth (the others: Shopify online, pop-up sales). Docs: https://doc.toasttab.com/doc/devguide/ --- ## Environment ```bash TOAST_API_HOST= # https://ws-api.toasttab.com (prod) / sandbox host TOAST_CLIENT_ID= TOAST_CLIENT_SECRET= # SECRET TOAST_RESTAURANT_GUID= # scopes every request TOAST_WEBHOOK_SECRET= # SECRET ``` --- ## Auth Client-credentials OAuth. The token is short-lived — cache it and refresh on expiry rather than fetching one per request. ```ts async function toastToken() { const res = await fetch(`${process.env.TOAST_API_HOST}/authentication/v1/authentication/login`, { method: "POST", headers: { "Content-Type": "application/json" }, body: JSON.stringify({ clientId: process.env.TOAST_CLIENT_ID, clientSecret: process.env.TOAST_CLIENT_SECRET, userAccessType: "TOAST_MACHINE_CLIENT", }), }); const { token } = await res.json(); return token.accessToken; // cache until token.expiresIn } ``` Every subsequent call needs **both** headers: ``` Authorization: Bearer <token> Toast-Restaurant-External-ID: <TOAST_RESTAURANT_GUID> ``` Omitting the restaurant GUID returns 403, not an empty result — which reads as an auth problem when it is a scoping problem. --- ## Reading orders ``` GET /orders/v2/ordersBulk?startDate=…&endDate=… ``` Dates are ISO-8601 **with timezone**. Toast