Developers

For companies that build services for restaurants and stores: payment systems, delivery, analytics. Here you register your app yourself and get Platform API keys at once — no application and no waiting for the PalomaPOS team. Only a business's owner can connect your app to that business, on the consent screen.

Every step, with links and a pointer for your AI assistant, is on the start page: https://sandbox.paloma365.com/developers.

If you only need a key to your own business — for your scripts or spreadsheets — you do not need an app: create a personal integration.

How to Access

Settings → Integrations section → Developers (/settings/developer-apps).

Only the account owner can create and change apps. Employees see the list without buttons.

Sandbox first, then production

	Sandbox	Production
Dashboard	https://sandbox.paloma365.com	https://dashboard.palomapos.com (USA), https://dashboard.paloma365.com (CIS)
API base	https://sandbox-api.paloma365.com/platform/v1	https://alfaposapi.palomapos.com/platform/v1 (USA), https://alfaposapi.paloma365.com/platform/v1 (CIS)
Account	a free test business: register it at https://sandbox.paloma365.com/register — it is your developer account and your test restaurant	your regular account on the market
Keys	sandbox keys, work only there	separate keys, different from the sandbox ones
Money	no real money	real businesses and real money

Build and test your integration in the sandbox, then create the app again in the dashboard of your market.

Fields

Field	Description	Required
App key	2–40 characters: lowercase latin letters, digits, _ and -, starting with a letter. It marks the orders your app creates. Cannot be changed	Yes
Name	Shown to the business owner on the consent screen and in the list of connected apps	Yes
Developer (company)	Who made the app	Yes
Description	A couple of sentences about the app	No
Logo URL	An image address, https:// only	No
Privacy policy, Terms of use	https:// links to your documents	Yes
OAuth redirect URIs	Exact https:// addresses, one per line; no wildcards	Yes
Scopes	What the app may ask the owner for. The owner may agree to less	Yes

Step-by-Step Guide

1. Press Create app and fill in the fields.
2. Press Create — a window shows client_id and client_secret.
3. Copy client_secret and keep it on your server. The secret is shown once: after you close the window it cannot be shown again, only replaced with a new one.
4. Connect the app to a business: the owner opens the connection link from the app card and presses Allow. Your app adds state and code_challenge for every connection.

Payment provider

If your app takes payments for QR menu online orders:

1. Add the scope Take payments for online orders as a payment provider (payments:process) — use Edit.
2. Press Make it a payment provider and enter the URL PalomaPOS sends payment sessions to (https://, a domain name, port 443), the payment methods, the currencies and whether you issue the fiscal receipt yourself.
3. Save the signing secret — it is shown once too. Your service verifies the signature of every request with it.

In the sandbox, a payment provider shows Sandbox checks: whether the app is connected to your test business and whether your service verifies the signature, answers sessions, confirms and declines payments. Your service orders test sessions through the API. When all checks pass, the block says Ready — you can go to production.

The shared list of payment providers

An app you registered yourself is not in the shared list of payment providers every business sees. A business sees it under QR Menu → Online orders only if its owner connected the app through your link. To be listed for every business of the market, write to the PalomaPOS team and ask for a review. After the review the card shows Listed for everyone.

Changing the name, developer, description or logo of a reviewed app removes it from the shared list until it is reviewed again.

Secrets, switching off and suspension

• New secret and New signing secret — the old secret stops working at once; the new one is shown once.
• Switch off — the app's keys stop working for every connected business until you switch it on again.
• Suspended by the team — the team stopped the app, for example after complaints. Its keys do not work and you cannot switch it on yourself — write to the team.

Tips

• Keep client_secret and the signing secret on your server only, never in a mobile app or website code.
• Give your AI assistant the start page https://sandbox.paloma365.com/developers or the index https://sandbox-api.paloma365.com/platform/llms.txt — they describe the whole process.
• You can create up to 10 apps per account.

FAQ

Do I have to wait for the team's approval?

No. Keys are issued at once, and access to a business's data is given by its owner. The team is needed only to be listed among payment providers for every business.

I lost my client_secret. What now?

Press New secret on the app card and update the secret on your server. The old one stops working at once.

Why don't sandbox keys work in production?

The sandbox and each market have their own app registry. Create the app again in your market's dashboard — it gets its own keys.