Stelno Partner API

Integrate in three steps

From zero to a pilot pumping fuel: an authorization redirect, a token exchange, and one authenticated POST.

1. 01Link

   Send the pilot through OAuth 2.0 + PKCE

   Redirect to Stelno's authorization endpoint with a S256 code challenge. The pilot signs in, reviews the scopes, and lands back on your redirect URI with a one-time code.

   GET https://stelnopay.com/oauth/authorize
     ?client_id=your-app
     &redirect_uri=https://your.app/callback
     &scope=profile:read aircraft:read fuel_sessions:read
            fuel_sessions:write receipts:read airports:read
     &state=<random>
     &code_challenge=<base64url(SHA-256(verifier))>
     &code_challenge_method=S256

2. 02Token

   Exchange the code for an access token

   Form-encoded, no client secret required for public clients — the PKCE verifier proves it was you who started the flow.

   curl -X POST \
     https://htnolhvggbtvvcqfcpfg.supabase.co/functions/v1/partner/oauth/token \
     -H "Content-Type: application/x-www-form-urlencoded" \
     -d grant_type=authorization_code \
     -d client_id=your-app \
     -d code=$CODE \
     -d code_verifier=$VERIFIER \
     -d redirect_uri=https://your.app/callback
   
   # → { "access_token": "...", "refresh_token": "...",
   #     "token_type": "Bearer", "expires_in": 3600 }

3. 03Fuel

   Start a fuel session and show the pump code

   One authenticated call returns the 6-digit code the pilot punches into the pump, plus a capacity warning when the ceiling exceeds usable tank volume.

   curl -X POST \
     https://htnolhvggbtvvcqfcpfg.supabase.co/functions/v1/partner/v1/fuel_sessions \
     -H "Authorization: Bearer $ACCESS_TOKEN" \
     -H "Content-Type: application/json" \
     -d '{ "pump_id": "…", "ceiling_cents": 15000, "n_number": "N528DP" }'
   
   # 201 Created
   # {
   #   "session_id": "0f3c…",
   #   "code": "418206",
   #   "expires_in_seconds": 90,
   #   "capacity_warning": null
   # }

Built for trust at the pump

Stelno-Signature: t=<ts>,
  v1=HMAC_SHA256(secret, t + "." + body)

POST /v1/receipts/verify
{ "receipt": { … }, "signature": "…" }
→ { "valid": true, "kid": "stelno-rcpt-1" }

GET /v1/fuel_sessions/{id}   # ~1/s
→ { "status": "authorized",
    "dispensed_gal_live": 12.4 }

POST /v1/route_plans
{ "origin": "KPAO", "destination": "KTRK", … }
→ { "fastest": { … }, "cheapest": { … } }