> ## Documentation Index
> Fetch the complete documentation index at: https://docs.eat-now.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication and scopes

> Authenticate requests and understand masked response fields.

Create a key in [Settings → Integrations → API keys](/integrations/api). The
restaurant needs the API feature. Store the full token server-side: it is shown
only at creation. The prefix in the list cannot authenticate a request.

## Verify a key

```bash theme={null}
curl 'https://app.eat-now.io/api/partner/v1/me' \
  -H 'Authorization: Bearer YOUR_API_TOKEN'
```

`GET /me` accepts any valid key without an additional scope and returns its
restaurant context and scopes. An expired, revoked or invalid key, or a
restaurant without the API feature, produces `401 INVALID_AUTHENTICATION`. A
missing scope produces `403 INSUFFICIENT_SCOPE`; `details.required_scopes`
identifies the required permissions. Staff roles are separate from key scopes.

## Scopes

| Scope                         | Purpose                                                                                            |
| ----------------------------- | -------------------------------------------------------------------------------------------------- |
| `CATALOG_READ`                | Tables, rooms, shifts, prescribers and discounts.                                                  |
| `AVAILABILITY_READ`           | Availability search and exact-slot check.                                                          |
| `RESERVATIONS_READ`           | Reservation search and detail.                                                                     |
| `RESERVATIONS_READ_SENSITIVE` | Unmask sensitive reservation response fields; also requires the scope for the operation.           |
| `RESERVATIONS_WRITE`          | Create and update reservations.                                                                    |
| `RESERVATIONS_FORCE_INSERT`   | On creation: bypass\_availability or initial\_status override, in addition to RESERVATIONS\_WRITE. |
| `RESERVATIONS_FORCE_CONFIRM`  | On creation: bypass\_approval, in addition to RESERVATIONS\_WRITE.                                 |
| `RESERVATIONS_CANCEL`         | Cancel reservations.                                                                               |
| `WEBHOOKS_WRITE`              | Selectable in the form, but no public v1 route manages webhooks. Use EatNow settings.              |
| `MISSED_CALLS_WRITE`          | Report missed calls; may send a WhatsApp message.                                                  |

## Sensitive fields

Without `RESERVATIONS_READ_SENSITIVE`, reservation responses mask:

* Search: `customer.email`, `customer.phone_number` and `customer.lang` are
  `null`.
* Detail, create, update and cancel: customer email, phone and language,
  `custom_message`, `allergies`, `metadata`, `feedback`, `total_amount_paid` and
  `payments` are `null`; `attached_files` is `[]`.

Customer name and ID remain visible, alongside unmasked fields such as tags and
cancellation reason. Payment summaries remain in search results. This scope is
therefore not a guarantee of responses without personal data. `customer: null`
can also mean an anonymous reservation. Do not overwrite your own stored data
with masked values.

Webhooks use a separate secret and are not filtered by API key scopes: they may
contain contact details, notes and payments.

The `sensitive_data_included` field reports whether sensitive access was
applied. Even with this scope, an invalid historical email address is returned
as `null`.

## Replace a key

A lost key cannot be retrieved. Create a replacement, update the connector,
verify `GET /me`, then revoke the previous key following your procedure. Never
send the token to support or place it in a URL.