Guest Identity Service (GIS)

Public, front-end facing API for user authentication and identity management. Supports legacy Email/Password flows, social login, passwordless (OTP), passkey authentication (WebAuthn / FIDO2), and enterprise SSO via SAML 2.0 and OIDC (Bring Your Own IDP).

Principles

• Use Access Tokens to call resource APIs (e.g: Ordering or Loyalty APIs).
• Tenancy is routed via the required client query parameter (generated through Oauth Application under Punchh business dashboard) on auth endpoints.
• All error payloads are PII-safe.

API Groups

• Advanced Authentication — The Advanced Authentication platform provides a set of APIs that can be integrated into mobile and web applications for passwordless authentication. These APIs allow for secure and efficient authentication processes, such as sending an OTP (One-Time Password) via email or SMS. By integrating these APIs, you can easily implement secure user login and verification mechanisms into your apps. The Advanced Authentication feature must be enabled for the business in the Punchh platform; otherwise, the API request will return an error. Contact your Punchh representative for more information about this Punchh platform configuration. For more information, see Advanced Authentication Overview. See also Advanced Authentication APIs.
• Auth — Signup, Sign-in, Refresh Token, Sign-out. See Auth APIs.
• Password — Forgot, Reset, Change. See Password APIs.
• Social — Google, Apple, Facebook. See Social APIs.
• Passkey — WebAuthn / FIDO2 passkey registration and authentication. Passkeys provide phishing-resistant, passwordless sign-in using platform authenticators (Face ID, Touch ID, Windows Hello) or hardware security keys. Registration requires a signed-in guest (Bearer token); authentication is unauthenticated. Passkey support must be enabled for the business (enable_passkeys). For a full integration guide, see Passkey Authentication. See Passkey APIs.
• Enterprise IDP Integration — Enterprise SSO via SAML 2.0 and OIDC using Bring Your Own IDP (BYOIDP). See Enterprise IDP Integration APIs.
• Health — Liveness/Readiness. See Health APIs.

Note on downstream Ordering/Mobile APIs

• When calling downstream Ordering/Mobile APIs, integrators may encounter 412 Precondition Failed due to an invalid x-pch-digest. This is not an Identity error—recompute the digest and retry.