Back to home

Your first API call in 5 minutes

3 steps from signing up to your first business request

Average time: 5 minutes

Step 1 Sign up and create an application

~3 minutes

1.1 Sign up in the portal

Create an account in the developer portal — it is where your applications and access keys will live.

Create an account

What to fill in:

Email — your work address; the confirmation letter goes there
Password — at least 8 characters: latin letters, digits and a special character
Password confirmation — repeat the same password
Consent to personal data processing

1.2 Confirm your email

The portal will send you a letter. Follow the link in it — that activates the account.

No letter? Check the Spam folder: delivery takes up to 2–3 minutes.

1.3 Fill in the company profile

The company profile is required to create applications and work with the API: the organization details are used in the agreement and in support requests. On your first sign-in the “Company Settings” panel opens by itself on the right. You cannot close it until the profile is filled in — that is a portal requirement, not an error.

Fill in the profile

What to prepare:

Country
Company Legal Name
Company Type
Tax ID (for Russian companies — also the registration ID)
Email and phone of the contact person for integration
A messenger for contact and your user name in it
Planned number of restaurants for integration

Until the profile is filled in, the “Create application” button stays disabled.

1.4 Create an application

Go back to the portal and click “Create application” in the “My applications” section.

Create application

Required fields:

Name — for example, “My integration”
Category — pick a suitable one from the list
Application type — choose your option
Short description — one or two sentences about your integration

Optional: full description, capabilities, logo (up to 10 MB).

The Client Secret is shown only once. Right after you save the application the system shows the Client Secret. Copy it and keep it in a safe place — a password manager or a .env file: once the window is closed you will not see it again. If the window did not appear, reset the Client Secret in the application card.

1.5 Get an API key in iikoWeb

The API key is created in iikoWeb and opens access to the organization's data.

Path in iikoWeb: Integrations → API Keys → Create key

Step-by-step guide: How to get an API key

After step 1 you should have:

appId — shown in the application card in the portal
clientSecret — application secret key, shown once at creation
apiKey — organization API key from iikoWeb; older instructions called it apiLogin

If something went wrong

Problem	Cause	Solution
“Email is already registered”	An account with this address already exists	Sign in through the login form or reset your password
The “Create application” button is inactive	Email is not confirmed or the company profile is not filled in	Follow the link from the letter and fill in the “Company Settings” panel — the portal opens it on sign-in
The “Company Settings” panel opened by itself and does not close	The company profile is not filled in yet — it is a required step before creating an application	Fill in the fields marked with an asterisk and click “Save” — the panel closes by itself. You can return to it later with the “Fill in profile” button
The letter does not arrive	The letter went to spam or is delayed	Check the Spam folder and wait 2–3 minutes

Step 2 Get a JWT token

~1 minute

A JWT token is a temporary session key for API requests. It lives for 1 hour, and there is no refresh token: once it expires, request a new one the same way. Every API request needs the Authorization: Bearer {token} header.

Endpoint

POST https://api-ru.iiko.services/api/v2/access_token

The request body contains three values from step 1: appId, clientSecret and apiKey.

// Get a JWT token
curl -X POST "https://api-ru.iiko.services/api/v2/access_token" \
  -H "Content-Type: application/json" \
  -d '{"appId":"{your_appId}","clientSecret":"{your_clientSecret}","apiKey":"{your_apiKey}"}'

// {
//   "token": "eyJhbGciOiJIUzI1NiIs...",
//   "correlationId": "abc-123-def"
// }

# Get a JWT token
import requests

url = "https://api-ru.iiko.services/api/v2/access_token"
payload = {
    "appId": "{your_appId}",
    "clientSecret": "{your_clientSecret}",
    "apiKey": "{your_apiKey}"
}

response = requests.post(url, json=payload)
print(response.json()["token"])

// Get a JWT token
const response = await fetch(
  "https://api-ru.iiko.services/api/v2/access_token",
  {
    method: "POST",
    headers: { "Content-Type": "application/json" },
    body: JSON.stringify({
      appId: "{your_appId}",
      clientSecret: "{your_clientSecret}",
      apiKey: "{your_apiKey}"
    })
  }
);
const { token } = await response.json();

// Get a JWT token
import java.net.http.*;
import java.net.URI;

var client = HttpClient.newHttpClient();
var body = "{\"appId\":\"{your_appId}\",\"clientSecret\":\"{your_clientSecret}\",\"apiKey\":\"{your_apiKey}\"}";

var request = HttpRequest.newBuilder()
    .uri(URI.create("https://api-ru.iiko.services/api/v2/access_token"))
    .header("Content-Type", "application/json")
    .POST(HttpRequest.BodyPublishers.ofString(body))
    .build();

var response = client.send(request, HttpResponse.BodyHandlers.ofString());
System.out.println(response.body());

// Get a JWT token
using System.Net.Http;
using System.Text;

var client = new HttpClient();
var payload = "{\"appId\":\"{your_appId}\",\"clientSecret\":\"{your_clientSecret}\",\"apiKey\":\"{your_apiKey}\"}";
var content = new StringContent(payload, Encoding.UTF8, "application/json");

var response = await client.PostAsync(
    "https://api-ru.iiko.services/api/v2/access_token", content);
var json = await response.Content.ReadAsStringAsync();
Console.WriteLine(json);

Successful response:

{
  "token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...",
  "correlationId": "abc-123-def"
}

Save the token value — you will need it in step 3.

If something went wrong

Error	HTTP code	Cause	Solution
Invalid credentials	`401`	A mistake in appId, clientSecret or apiKey	Check appId and clientSecret in the application card, apiKey — in iikoWeb → Integrations → API Keys
Invalid request format	`400`	A mistake in the JSON or the headers	Check that you send the Content-Type: application/json header
Connection refused	—	Wrong address	The domain must be api-ru.iiko.services

Step 3 Make your first business request

~1 minute

An organization is a restaurant. The request returns every organization your API key has access to.

Endpoint

POST https://api-ru.iiko.services/api/1/organizations

The header carries the token from step 2; the request body is an empty object — that returns all available organizations.

// Get the list of organizations
curl -X POST "https://api-ru.iiko.services/api/1/organizations" \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer {your_token}" \
  -d '{}'

// {
//   "organizations": [
//     { "id": "...", "name": "..." }
//   ],
//   "correlationId": "..."
// }

# Get the list of organizations
import requests

url = "https://api-ru.iiko.services/api/1/organizations"
headers = {
    "Content-Type": "application/json",
    "Authorization": "Bearer {your_token}"
}

response = requests.post(url, headers=headers, json={})
data = response.json()

for org in data["organizations"]:
    print(f"ID: {org['id']}, {org['name']}")

// Get the list of organizations
const url = "https://api-ru.iiko.services/api/1/organizations";

const response = await fetch(url, {
  method: "POST",
  headers: {
    "Content-Type": "application/json",
    "Authorization": "Bearer {your_token}"
  },
  body: JSON.stringify({})
});

const data = await response.json();
console.log(data.organizations);

// Get the list of organizations
import java.net.http.*;
import java.net.URI;

HttpClient client = HttpClient.newHttpClient();
HttpRequest request = HttpRequest.newBuilder()
    .uri(URI.create("https://api-ru.iiko.services/api/1/organizations"))
    .header("Content-Type", "application/json")
    .header("Authorization", "Bearer {your_token}")
    .POST(HttpRequest.BodyPublishers.ofString("{}"))
    .build();

HttpResponse<String> response = client.send(request,
    HttpResponse.BodyHandlers.ofString());
System.out.println(response.body());

// Get the list of organizations
using System.Net.Http;
using System.Text;

var client = new HttpClient();
var request = new HttpRequestMessage(HttpMethod.Post,
    "https://api-ru.iiko.services/api/1/organizations");

request.Headers.Add("Authorization",
    "Bearer {your_token}");
request.Content = new StringContent("{}",
    Encoding.UTF8, "application/json");

var response = await client.SendAsync(request);
var json = await response.Content.ReadAsStringAsync();
Console.WriteLine(json);

Successful response:

{
  "organizations": [
    {
      "id": "a1b2c3d4-e5f6-...",
      "name": "My restaurant",
      ...
    }
  ],
  "correlationId": "abc-123-def"
}

organizations[].id — organization UUID, used by other API methods
organizations[].name — restaurant name
correlationId — request identifier: mention it when contacting support

If something went wrong

Error	HTTP code	Cause	Solution
Token expired	`401`	A JWT token lives for 1 hour	Repeat step 2 to get a new token
Empty organization list	`200`	The API key is not linked to an organization	Link the key to an organization in iikoWeb
Invalid request format	`400`	A mistake in the headers	Check the Authorization: Bearer {token} header

Congratulations! Your first iiko API call is done.

Your time: —

From here you can call any Cloud API methods — from menu and orders to loyalty and documents.

What is next?

Read the guides Step-by-step integration scenarios with code samples API reference All Cloud API methods with parameter descriptions Integrator support The IntegratorsKit programme: a demo stand and answers in chat Telegram community Questions, discussions and release announcements

Progress

Step 1: Sign up
Step 2: JWT token
Step 3: First request

Prerequisites

Internet access
An email for signing up
Access to iikoWeb — the organization API key is created there
A terminal or an HTTP client: curl, Postman

Glossary

appId: Unique application identifier, used in API requests
clientSecret: Application secret key. Shown once — never share it with third parties
apiKey: Organization key from iikoWeb → Integrations → API Keys. Older instructions called it apiLogin
JWT: Temporary session key for API requests. It lives for 1 hour

Something went wrong?
api@iiko.ru