Authentication & getting started

Introduction

The Food Web Platform API exposes the whole platform — map and discovery, kitchen bookings, payments, credits, referrals, messaging and moderation — over a single HTTPS surface. Most endpoints return JSON and accept JSON bodies. Public map reads need no credentials; everything else is authenticated with a Firebase identity token.

Base URL

All requests go to a single origin:

https://api.foodweb.network

Every documented path is prefixed with /v1, e.g. /v1/map/entities.

Authentication

Authenticated requests carry a Firebase ID token as a Bearer token in the Authorization header. The API verifies the token on every request and resolves your account and roles from it.

Authorization: Bearer <firebase-id-token>
Content-Type: application/json

You obtain an ID token by signing in to your Food Web account — through the Firebase client SDK in your own app, or from the developer dashboard on the main site. Tokens are short-lived; refresh them with the Firebase SDK rather than hard-coding a single value.

Public endpoints

Map and discovery endpoints under /v1/map/* are public — send no Authorization header at all.

Verified email & roles

Some endpoints additionally require a verified email (suggestions) or a specific role (admin/moderation). Those return 403 forbiddenif your account doesn't qualify. Browser clients additionally send a Firebase App Check token (X-Firebase-AppCheck) on select routes.

Making requests

Send and receive application/json. List endpoints are keyset-paginated: when more results exist, the response includes a next_cursor you pass back on the next request.

# Public — no credentials required
curl https://api.foodweb.network/v1/map/cities

Errors

Errors use a consistent envelope and a matching HTTP status. The code is stable and safe to branch on; message is for humans. Some errors include an optional details object.

{
  "error": {
    "code": "unauthorized",
    "message": "Invalid or expired token"
  }
}

Status	Code	When
400	validation_error	The request failed validation — check the message and details.
401	unauthorized	Missing, invalid, or expired token.
403	forbidden	Email not verified, or the account lacks a required role.
404	not_found	The resource does not exist or is not visible to you.
409	conflict	The request conflicts with current state (e.g. a duplicate).
500	internal_error	Something went wrong on our side — safe to retry.

Quickstart

Two minutes to your first authenticated response.

1
Get a token
Sign in to Food Web and obtain a Firebase ID token for your account (via the Firebase SDK in your app, or the developer dashboard).

Export it to your shell

export FOODWEB_TOKEN="<firebase-id-token>"

Make your first call

List your credit balance — an authenticated GET.

# Authenticated — send your Firebase ID token
curl https://api.foodweb.network/v1/me/credits \
  -H "Authorization: Bearer $FOODWEB_TOKEN"

Next steps

Browse every endpoint — parameters, request bodies and response shapes — in the interactive reference.

Explore the full reference