Build on GrillTab.

Getting started

The restaurant owner makes a key in the owner dashboard (API keys), picks the locations and what it can read or change, and gives it to you. The key is shown once. Send it on every call:

curl https://hq.grilltab.com/api/v1/locations \
  -H "Authorization: Bearer gt_live_…"

Every call is relayed live to the location's own POS computer, so data is always current. If that computer is offline the call answers 502; try again later. Limit: 120 calls a minute per key (429 past that). Errors are JSON, in plain English: {"error": "…"}.

Try it now: the sandbox

This public test key works on a made-up bar, Demo Taproom (location 1), with realistic sales, checks, menu, labor and inventory. Every call answers exactly like the real API; writes are checked and echoed back, never kept. Up to 60 calls a minute.

curl "https://hq.grilltab.com/api/v1/locations/1/sales?from=2026-10-24&to=2026-10-30" \
  -H "Authorization: Bearer gt_test_demo_taproom_public_sandbox"

Read

Dates are business days (YYYY-MM-DD); a business day ends at the location's day-end time, not midnight. Times are the store's local time. Money is in dollars.

Write

Only keys the owner gave a write scope can change anything, and every change shows in the location's activity log.

Send an order

POST /api/v1/locations/12/orders
{
  "external_id": "A-1001",          // your order number: a retry never makes a second order
  "type": "pickup",                 // pickup | delivery | dine_in (with "table")
  "pickup_at": "2026-11-01 18:30",  // optional, store time: the kitchen fires it on time
  "customer": { "name": "Pat", "phone": "5551234567" },
  "items": [ { "menu_item_id": 534, "qty": 2, "notes": "extra crispy",
               "modifiers": [ { "name": "Ranch" } ] } ],
  "notes": "Leave at the bar"
}

The location picks orders up within a minute while it's online, prints the ticket and sends it to the kitchen screens.

Webhooks

A manager adds your https address in the POS back office (Integrations → Webhooks) and gives you its secret. Each event is a POST of { id, event, created_at, location, data } with the headers X-GrillTab-Event, X-GrillTab-Delivery and X-GrillTab-Signature: t=<unix seconds>,v1=<hex>. Answer with a 2xx. Failed deliveries are retried after 1 min, 5 min, 30 min, 2 h, 6 h and 24 h, and every delivery can be sent again from the POS.

Check the signature

const crypto = require('crypto');
function valid(rawBody, header, secret) {
  const { t, v1 } = Object.fromEntries(header.split(',').map((p) => p.split('=')));
  const want = crypto.createHmac('sha256', secret).update(`${t}.${rawBody}`).digest('hex');
  return Math.abs(Date.now() / 1000 - Number(t)) < 300 && v1.length === want.length && crypto.timingSafeEqual(Buffer.from(v1), Buffer.from(want));
}

Nightly export

Each morning a location can send the business day as CSV files in one .zip to a folder, an https address or an SFTP server (Settings → Providers → Nightly export). Each .zip has a FIELDS.txt with the list below. The owner can also download every table at any time (Settings → Providers → Your data).

OrderDetails.csv

ItemSelectionDetails.csv

PaymentDetails.csv

TimeEntries.csv

Changelog

• 2026-10-31: Write API (86s, counts and prices; orders in, with status). A field guide in every nightly export.
• 2026-10-31: Read API v1 (sales, checks, menu, labor, inventory, employees) and signed webhooks.

Questions or a partnership? Get in touch.