Developer / APIOverview

Developer / Integration

Connect HummyTummy to your own systems: run your own screens/apps, stream order and payment events to your server, and access restaurant data over the REST API. Every endpoint lives under a single API base:

https://hummytummy.com/api

All REST paths are served under the /api global prefix. Every example in these docs shows the full path (e.g. POST /api/v1/webhooks/subscriptions). Currency is always TRY.

Which integration fits you?

HummyTummy exposes three distinct integration surfaces; most integrators use more than one together.

Base URL, auth realms (staff JWT / customer session / partner key / screen token), the X-Branch-Id branch scope, pagination, the error envelope, idempotency, and rate-limit tiers.

API Fundamentals

Run your own screens, such as a table tablet: menu, ordering, waiter/bill calls, self-service payment, and live order status. ADMIN key → screen token → /v1/display/* + WebSocket.

Partner Display API

Receive order, payment, and subscription events as HMAC-SHA256–signed POSTs to your endpoint. Subscribe, verify signatures, event types, retries, and SSRF protection.

Webhooks

Two directions: pull and push

  • Pull — you call the REST endpoints (read the menu, place an order, start a payment). For auth and branch-scope rules, see API Fundamentals.
  • Push — when an event happens, we POST to your endpoint (outbound webhooks). For setup and verification, see Webhooks.

Authorization realms (at a glance)

RealmHow it authenticatesTypical use
Staff JWTAuthorization: Bearer <jwt>Dashboard / management API, key & webhook management
Customer sessionQR-menu session tokenGuest ordering & self-pay
Partner keyX-Partner-Key + X-Partner-SecretPartner backend mints screen tokens
Screen tokenAuthorization: Screen <token>Device calls /v1/display/*

The full detail of each lives in API Fundamentals.

⚠️

Partner Display and outbound webhooks are plan-gated features. Partner Display requires the tenant’s plan to include externalDisplay; webhook subscriptions require apiAccess (API access). Otherwise the relevant endpoints return 403.

HomeAPI Fundamentals