Changelog post: v2.2026.1001

This release brings three updates: two security changes to how API credentials work, a new Orders API for sales data, and a new MCP server that connects your AI coding assistant directly to our docs and spec.

❗️
Action may be required
Starting October 31, 2026, each API credential can only access the company it was created for. If you use one token or grant across multiple companies, review the Security updates section below before that date.

Security updates

Protecting your customers' data is our top priority. We're making two changes to how API credentials are managed.

1. Credentials limited to a single company (effective October 31, 2026)

Each access token and OAuth grant will only be able to access the company it was created for. Credentials will no longer reach data across multiple companies. This keeps each company's data isolated and limits exposure if a credential is ever compromised.

What you need to do:

If you are...	Do this
An access token user managing more than one company	Create a separate access token for each company
An integration partner using OAuth	Make sure every request uses the OAuth grant issued for the company whose data you're requesting
Already using one credential per company	No action needed

Check which company a credential belongs to:

curl --request GET 'https://app.7shifts.com/api/v2/verify' \
  --header 'Authorization: Bearer {ACCESS_TOKEN}'

OAuth clients must also include the grant's x-company-guid header.

{
  "data": {
    "company_id": 123456,
    "company_name": "Company Name",
    "credential_type": "access_token"
  },
  "object": "credential_verification"
}

If the company returned isn't the one you expect, create a new token or grant for the correct company before October 31, 2026.

2. Inactive access tokens are removed automatically

Access tokens with no API activity for more than 6 months will be removed. This reduces the risk of forgotten tokens being exposed or misused.

If you have a token you rely on infrequently, make sure it's used at least once every 6 months, or create a new one under Company Settings → Developer Tools when you need it. See Authentication.

New: Orders API (replacing Receipts)

We've introduced the /orders API, the new way to send sales data into 7shifts. It will eventually replace /receipts.

Orders let you send richer, more accurate sales data, which unlocks more 7shifts features for your customers. Restaurant operators get sharper sales forecasting, better labor-to-sales reporting, and more accurate tip handling.

What's new compared to Receipts:

One call to create or update. PUT /orders/{external_id} is an idempotent upsert. No separate POST for the first write.
True deletes. DELETE /orders/{external_id} soft-deletes an order and its payments and line items in one call.
Payments as first-class objects. Tips, gratuities, fees, and payment type are recorded per payment instead of summed on the receipt.
Reference data. Revenue centers, sales categories, and dining options are now their own resources, replacing free-text labels.
New fields. tax, fees, external_business_date, non_revenue_total, item_count, is_revenue_item, and a refund status.
Unresolved references don't fail the write. If a referenced revenue center, dining option, or sales category doesn't exist yet, 7shifts creates a placeholder and returns a warnings[] entry.

📘
Receipts sunset
A sunset date for /receipts has not been set yet. We strongly encourage all partners to start migrating now. Partners on /orders will get access to new sales features first, and we'll give advance notice before /receipts is retired.

🚧
Send your oldest order first
The first order sent for a location sets its receipts-to-orders transition date, and that date can't be moved by later writes. Send your oldest order first, including historical backfill, so earlier orders aren't hidden from Orders reads.

Get started:

New integration: Create/Update Orders
Existing Receipts integration: Migrating from Receipts to Orders (field-by-field mapping, side-by-side example, and rollout checklist)

New: 7shifts MCP Server for AI coding assistants

You can now connect your AI coding assistant (Claude Code, Cursor, GitHub Copilot, Claude) directly to the 7shifts API spec and documentation. Instead of copying docs into a chat window, your assistant reads the real endpoints, schemas, and integration guides.

Server URL: https://developers.7shifts.com/mcp

What your assistant can do:

List every endpoint and read full request and response schemas
Search and read our integration guides (sales, employee sync, schedule enforcement, and more)
Make live GET requests against your account, if you add an access token

Connect in one line (Claude Code):

claude mcp add --transport http 7shifts https://developers.7shifts.com/mcp

No credentials are needed to browse endpoints or search docs.

📘
Read-only by design
The MCP server exposes GET endpoints only. Nothing your assistant does through it can modify or delete data. It can still read schemas for write endpoints and generate code for you to review and run yourself.

We encourage every partner to try it, especially if you're migrating to the new Orders API. Ask your assistant to compare your Receipts payload to the Orders schema and draft the mapping for you.

Get started: Build with AI and MCP Server

Questions? Post in Discussions