A hosted storefront serves published products, while revocable API access supports a separately built external ordering experience.
Open a tenant-branded hosted storefront
The public /shop/{tenantSlug} catalog displays products explicitly published for online sale. Customers build a server-priced cart, provide pickup or ship-to details, complete age attestation where required, and submit a pending order. No payment is captured by this hosted order-submission path.
Connect an external ordering experience when the business needs one
Authorized staff can create and revoke online-order API keys. The raw secret is returned once so the integration can store it securely; later administration identifies and revokes the credential without revealing it again. This is a second intake path, not a requirement for using the hosted storefront.
Let the server decide what is sellable
The order path submits product identity and context; the server resolves authoritative products and prices, calculates tax and discounts, reserves inventory or rejects the order, and rejects duplicate external order identities instead of trusting client-provided totals.
Advance one allowed order state at a time
Orders use the explicit pending → confirmed → preparing → ready → completed path, with cancellation only where the current state allows it. The operations queue can filter channel work and poll for new activity without losing the source order identity.
Keep fulfillment context and payment evidence separate
The detail record keeps customer and contact information, items, quantities, totals, notes, fulfillment branch, and the Payment badge together. A pickup or ship-to decision does not itself prove payment, and any shipping workflow remains configuration-specific.
Reconcile the queue with the records behind it
Before completion, compare queue status, reserved stock, source identity, sales ledger, payment evidence, and any configured shipping record. Cancellation changes the order workflow; captured-funds refunds and carrier-side reversals remain separate operator-controlled processes.
Reconcile hosted and external intake through every allowed state
Publish one test product to the hosted storefront and submit one pickup or ship-to order, then separately test API-key creation and revocation if an external channel is in scope. Include a duplicate external identity and an insufficient-stock attempt. Verify server price and tax, fulfillment context, Payment badge, reserved stock, allowed status transitions, and the separate evidence required before completion or cancellation.
Inspect in the live demo
Open Online Orders, inspect the external identity and server total, then follow the allowed status path. Availability can depend on enabled modules, hardware, payment setup, role, location, and rollout configuration.
Move from the feature to the operation
This capability shares customer, employee, product, location, transaction, and reporting context with the rest of LiftedPOS. The value is not a checked box. It is the handoff the operation no longer has to rebuild.