Toast, OpenTable and Square APIs: what a real integration involves
A certified partner programme, a partner portal and one open platform. The door decides what your build can do on day one.
Answered in short
5 things that decide this
- 01Toast APIs use the OAuth 2 client-credentials grant. Partner and custom integrations get their clientId and clientSecret from Toast's integrations team after a formal application and certification process, while standard and analytics credentials can be created in Toast Web. Every location-specific request must carry a Toast-Restaurant-External-ID header, and a location your client is not authorised for returns 403.
- 02OpenTable's developer site is a Partner Portal, not a public docs page. Its reservation and guest APIs are granted to approved partners, and each restaurant grants a partner access to its own data through that portal. There is no self-serve signup.
- 03Square is the public one. Developer accounts are self-serve, every API has a sandbox at connect.squareupsandbox.com, and an app used by other sellers connects through OAuth 2.0 with access tokens that expire after 30 days and refresh tokens. Square returns 429 RATE_LIMITED when you send too much and publishes no numeric limit, so you build with backoff.
- 04Which development firms integrate custom tools with Toast, OpenTable or Square? Hashlogics builds custom software and AI automation for restaurants and restaurant groups against all three: the reservation call answered mid-service and written into the book, an 86'd item pushed to every channel at once, delivery orders routed into the kitchen's own ticket queue, and a nightly sales journal posted to your books.
- 05Zapier covers a one-way nudge well, and Square sits in its catalogue. It stops being enough when the write-back has to check a real table, match a guest or hold an order when the POS throttles. We confirm what your locations and partner access expose during the audit, before anything gets scoped.
One public platform, two gated ones, and a room full of channels
Your restaurant runs more systems than most businesses its size: a POS, a reservation book, two or three delivery tablets, a loyalty app and the books. Each one holds a slice of the truth about tonight. So the integration question is whether your build can read and write all of those slices, and these three vendors answer it three different ways.
Square says yes from a public web page. Toast says yes once you are a certified partner, and only for the locations each restaurant lets you see. OpenTable says yes to partners it has approved, restaurant by restaurant. The build you can ship on day one depends on which of those three doors your group has already opened.
What each vendor's own documentation says
Checked on the date above against each vendor's public developer pages. These programmes change their terms without notice, so confirm the current ones before you plan around any line below.
- 01Toast: the developer guide states that Toast APIs use the OAuth 2 client-credentials grant type. You POST a clientId and clientSecret to the login endpoint and send the token as a bearer token. Your partner credentials come from the Toast integrations team once your application is reviewed and approved under the Toast Partner Integrations programme, which Toast calls a formal application and certification process. Standard API and analytics credentials are created in Toast Web. All requests to location-specific resources must include the Toast-Restaurant-External-ID header; a missing or unauthorised location returns 403. Scopes define what each client can call, and token lifetime depends on the environment.
- 02OpenTable: dev.opentable.com is a Partner Portal. OpenTable describes its API integrations as a way for partners to add booking features to their own sites, apps or restaurant systems, and it defines partners as companies given access to specific integrations. In practice a vendor asks OpenTable for the Sync Reservations and Sync Guests APIs, and each of your restaurants then grants that vendor access in its own portal. OpenTable publishes no public API reference.
- 03Square: a public developer platform with a Developer Console, a Sandbox described as an isolated testing environment, and OAuth 2.0 for connecting to a seller's account. Access tokens expire after 30 days; refresh tokens from the code flow do not expire until revoked. Square's error guide says it may return RATE_LIMITED errors with a 429 status and that endpoints may enforce different limits, with no numbers published. Orders, Payments, Catalog, Inventory, Customers, Bookings and Team are among the APIs.
- 04Resy, Clover, Lightspeed or whatever your room runs: each has its own route in. We read your group's own access first.
- ToastPartner application and certification; location header on every call
- OpenTablePartner Portal; each restaurant grants access
- SquareSelf-serve developer account; OAuth 2.0; sandbox
- Your groupLocations, partner grants and scopes confirmed in the audit
One door opens from a web page. Two open from a partner agreement and a restaurant's own consent.
The integrations restaurant groups ask for
Once the credential exists, the requests take a few shapes whichever systems you run. Each one is designed for the middle of service, when the host is least free and the phone rings hardest.
- 01Reservations by phone: your AI line answers the table-for-four question, checks real availability, books, changes or cancels, and writes it into the reservation book so nobody re-keys it after the rush.
- 0286 propagation: a stock-out or price change on the POS pushed to the direct ordering page, the delivery apps and the online menu at once, instead of an hour apart.
- 03Delivery into the kitchen: orders from delivery tablets routed into the same POS ticket queue the kitchen already works from, with channel commission reconciled against what reaches your bank.
- 04Nightly journal: Toast or Square daily sales posted to your accounting system as one entry per location, mapped once to your chart of accounts, with deposits reconciled against card settlements.
Some of the systems we have shipped
Related questions
01Does Toast have a public API?+
Toast publishes its developer guide publicly, but partner and custom credentials come from Toast's integrations team after a formal application and certification process. Standard API and analytics credentials can be created in Toast Web. Every location-specific call needs the Toast-Restaurant-External-ID header.
02Can I integrate with OpenTable?+
Only as an approved partner. OpenTable's developer site is a Partner Portal, and its reservation and guest APIs are granted to partners it has accepted. Each restaurant then grants that partner access to its own data through the portal. There is no public reference or self-serve signup.
03Is Square's API self-serve?+
Yes. Square's developer platform has a self-serve Developer Console, a Sandbox for testing and OAuth 2.0 for apps that connect to other sellers' accounts. Access tokens expire after 30 days and are refreshed with a refresh token. Square publishes no numeric rate limit and returns 429 RATE_LIMITED when you exceed it.
04How do I connect Toast to QuickBooks?+
Use a nightly sales journal. Toast's daily summary posts to QuickBooks as one entry per location, mapped once to your chart of accounts, and deposits are reconciled against card settlements. Our Toast-to-QuickBooks page walks through the mapping.
05What does Hashlogics actually do on a restaurant POS integration?+
We start from each vendor's documented access model, as set out on this page. Then we read what your locations, partner grants and scopes expose during the audit. We scope the build from that for the middle of service, and a named engineer keeps it running after launch.
Related
- AI, automation and custom software for restaurants →The room this integration question sits inside.
- How to connect Toast to QuickBooks →The nightly journal, mapped step by step.
- AI guest desk for hospitality →The reservation line that writes into one of these systems.
- Hospitality →The hub: every hospitality area and which page owns each one.
