TMPT-449 · manual sandbox probe

Foodics Flow Tester

A local page for driving the real OAuth + API flow by hand once sandbox credentials arrive. Fill in your own client_id / client_secret below (nothing here is sent anywhere except directly to Foodics from your own browser). Everything persists to this browser's localStorage only.

CORS heads-up: Foodics's API is built for server-to-server calls, so the browser may block the fetch attempts below with a CORS error — that is not a sign anything is wrong. Every step also prints the equivalent curl command; run it in a terminal and paste the JSON response back into the box below it to keep going.

Environment & credentials

Sandbox Production

client_id

client_secret

redirect_uri (must exactly match what's registered with Foodics)

Authorize

Per the docs, only client_id and state are query params here — redirect_uri is not passed per-request, it's whatever was registered with the app.

not generated yet

01a

Convert a real callback URL to localhost:4200

Foodics is currently only registered to redirect to https://partner.demo.dr.tmd1.org/foodics-callback, so a real authorization always lands there first — not on your local dev server. Paste that full URL (with ?code=...&state=...) here to test against a local ng serve on port 4200 instead. This only rewrites the origin/path for your browser; the backend's token-exchange call still sends the real registered redirect_uri, so the code stays valid with Foodics.

real callback URL (copied from the address bar after Foodics redirects you)

not converted yet

A Foodics code is single-use and short-lived — if it was already exchanged (here or by the real deployed callback), converting it again won't get you a fresh one.

Exchange code for token

After approving access, Foodics redirects to your redirect_uri with ?code=...&state=.... Paste both below — the state must match what step 01 generated. If this page itself is opened with ?code=...&state=... on its own URL, both fields below fill in automatically.

code

state

not attempted yet

curl fallback

fill in client_id / client_secret / code / state first

or paste the curl response here

no access_token loaded yet

Explore the API

Uses the access_token loaded in step 02 (from the browser attempt or the pasted response).

no call made yet

curl fallback (last call)

make a call above first

Webhook payload inspector

Paste a real webhook delivery from Foodics (sandbox console lets you trigger test events). This checks the payload against what our design currently assumes — business.reference and a nested branch object per the docs, not flat business_id/branch_id fields.

raw webhook JSON

not inspected yet

Decrypt a stored token (AES-256-GCM)

Tokens saved into the storeIntegrations Mongo collection (Properties.accessToken / refreshToken) are encrypted with FoodicsCredentialEncryptor before being persisted — pasting that blob straight into an Authorization: Bearer header will always 401. This decrypts it locally in your browser using the same AES-256-GCM scheme (12-byte nonce + ciphertext + 16-byte tag, all base64) so you can get the real token back out.

FoodicsSettings.EncryptionKey (base64, from appsettings for the environment the document came from)

encrypted value (e.g. Properties.accessToken from the Mongo document)

not decrypted yet

Nothing here leaves your browser — decryption runs via the Web Crypto API, same as every other step on this page.