Authentication

Every request needs two headers: a bearer token that identifies the caller, and the UUID of the organization the request is about. Requests missing either one are rejected before reaching any endpoint.

Headers

Header	Value	Missing or wrong
Authorization	Bearer your-access-token	401 Unauthorized
X-CANTEEN-ORGANIZATION	Organization UUID	400 Bad Request when absent, 404 Not Found when the UUID does not exist

The token must belong to a user who is a member of the organization named in the header. If it is not, the API answers 403 Forbidden. This is what stops a token from one organization reading data from another.

Example

curl https://api.canteenweb.com/api/v1/admin/establishments \
  -H "Authorization: Bearer your-access-token" \
  -H "X-CANTEEN-ORGANIZATION: 9e11ee05-32a4-4898-8735-5a7f88003409"

Why a header and not a subdomain

Earlier versions of these docs pointed at https://<organization>.canteenweb.com. That form is no longer supported. The organization travels in the header, and the base URL is the same for everyone: https://api.canteenweb.com. If you still have the old hostname in a configuration file, update it.

Token lifetime

Tokens do not expire on their own. They stop working when we revoke them, which happens on request or when the user they belong to leaves the organization. Plan for a 401 at any time and surface it clearly in your logs rather than retrying.