---
service: Fuoco Antico - Secret Pizza
domain: fuocoantico.com
auth_methods:
  - none
  - checkout_handoff_link
  - sms_otp_customer_token
---

# Fuoco Antico - Secret Pizza — AI Agent Authentication & Checkout Authorization (`auth.md`)

## 1. Public Read & Quote Endpoints (No Authentication Required)
The following read-only and dry-run endpoints are publicly accessible without API keys or tokens:
- **Live Menu & LLM Manifest:** `GET https://scintilla.brobotindustries.com/be/public-api.php?funct=get_llm_manifest&tenant=fuoco-antica`
- **Dry-Run Order Quote:** `POST https://scintilla.brobotindustries.com/be/public-api.php` (`funct=quote_order`)
- **Prepare 1-Click Checkout Link:** `POST https://scintilla.brobotindustries.com/be/public-api.php` (`funct=prepare_agent_checkout`)
- **Remote MCP Server:** `POST https://scintilla.brobotindustries.com/be/public-api.php?funct=mcp&tenant=fuoco-antica`
- **Order Status Lookup:** `GET https://scintilla.brobotindustries.com/be/public-api.php?funct=get_order_status&tenant=fuoco-antica&order_number={ORDER_NUMBER}&customer_phone={PHONE}`

## 2. Authorizing Customer Orders & Payments on Behalf of a Human
To protect kitchen operations and customer payment security, Fuoco Antico - Secret Pizza supports two human-authorized checkout flows:

### Flow A: 1-Click Pre-Loaded Storefront Checkout Link (Default for All Customers)
1. Call `funct=prepare_agent_checkout` (or MCP tool `prepare_agent_checkout`) with `customer_name`, 10-digit `customer_phone`, `pickup_slot_time`, and `cart_items_json`.
2. The API returns `checkout_url` (`https://fuocoantico.com/?agent_checkout=chk_...`).
3. Share `checkout_url` with the human customer (or set `send_sms_link=1` and `sms_opt_in=1` with explicit user consent to text the link to their phone).
4. The human clicks the link to review their pre-loaded cart and complete payment via **Apple Pay**, **Google Pay**, or **Credit/Debit Card** in one tap.

### Flow B: Conversational SMS OTP + Saved Card on File (Returning Customers)
If `quote_order` indicates `customer_payment_options.has_card_on_file: true`:
1. **Request OTP:** `POST https://scintilla.brobotindustries.com/be/public-api.php` with `funct=send_customer_otp`, `tenant=fuoco-antica`, and `phone={10_DIGIT_PHONE}`.
2. **Verify OTP:** Ask the human for the 6-digit SMS code and call `POST https://scintilla.brobotindustries.com/be/public-api.php` with `funct=verify_customer_otp`, `tenant=fuoco-antica`, `phone={10_DIGIT_PHONE}`, and `code={6_DIGIT_CODE}`.
3. **Receive Token:** Extract `data.customer.customer_token` (or `customer_token` from the MCP `verify_customer_otp` tool).
4. **Submit Paid Order:** Pass `customer_token` (via POST field `customer_token` or HTTP header `X-Spark-Customer-Token`) along with `use_card_on_file=1` to `funct=place_order`.