Skip to content
Get API key

Sansflow Developers

Build on the counter.

One REST API, signed webhooks and an MCP server for the shops, cafés and salons that run Sansflow POS. Read sales, send orders to the till, confirm bookings, or let an AI assistant answer questions about the business.

API v1 is live · test and live keys

Quick start

Your first call in a minute

  1. Create a test key In Sansflow, open Developers and create an sf_test_ key with the business.read scope. It is shown once.
  2. Call the API Send it as a Bearer token. The answer lists the outlets the key may read.
  3. Go live Swap in an sf_live_ key with the scopes your integration needs.

Read the guide

GET /api-v1-locations
curl https://ewpuclvmnygoddunkyrb.supabase.co/functions/v1/api-v1-locations \
  -H "Authorization: Bearer $SANSFLOW_API_KEY"
Response
{
  "data": [
    {
      "id": "6f1c2a4e-…",
      "name": "Main",
      "type": "storefront",
      "is_default": true,
      "is_active": true,
      "address": null,
      "phone": null,
      "receipt_name": null,
      "operating_hours": null,
      "tax": { "enabled": false, "rate": null, "label": null }
    }
  ],
  "request_id": "…"
}

Get your API key

The API, webhooks and MCP are part of Sansflow Premium. The business owner creates keys in the Sansflow app and hands them to the developer.

  1. 01

    Sansflow Premium

    The business is on Sansflow Premium. Without it the API answers 402 payment_required.

  2. 02

    Open Developers

    In pos.sansflow.com, open Developers. Owners and anyone allowed to manage the API see it.

  3. 03

    Create a test key

    Name it, pick its scopes and, if you like, one outlet. Copy it: only its hash is kept.

  4. 04

    Switch to live

    Build against sf_test_, then create an sf_live_ key for real data.

Built for the work around the code

The Developers page in Sansflow is where keys, AI tokens and webhooks live, next to a log of every request.

Test keys

sf_test_ keys price orders exactly like live ones but never reach the till, the kitchen or reports.

Test and live

Request log

Every call is logged with its status, time taken and error code. Quote the request_id when you ask for help.

Errors

Signed webhooks

HMAC-SHA256 signatures, five retries over about 8½ hours, and a send-test button for your endpoint.

Webhooks

MCP server

Personal tokens for Claude and ChatGPT: read-only by default, scoped to outlets, revocable.

MCP