resy-fpx

Resy via curl (+ one-time fpx bootstrap)

Resy has no public API — resy-mcp calls the same api.resy.com endpoints the resy.com web app calls, all of which are reachable with plain curl; nothing here needs a bot-wall bypass. The browser bridge (fpx) is only needed to mint an auth token when you have no email/password on hand — after that, every actual call (search, slots, book, cancel, favorites, notify, profile) is a direct curl with the token in a header. This mirrors resy-mcp's own "Pattern B": bridge the one auth call, then go direct for the hot path (see src/client.ts / src/auth-fetchproxy.ts in the resy-mcp repo).

Step 1 — get a token (pick ONE path)

Path A — you have Resy credentials (preferred, no browser needed):

curl -s 'https://api.resy.com/3/auth/password' \
  -H 'Authorization: ResyAPI api_key="VbWk7s3L4KiK5fzlO7JD3Q5EYolJI7n5"' \
  -H 'Content-Type: application/x-www-form-urlencoded' \
  --data-urlencode "email=$RESY_EMAIL" \
  --data-urlencode "password=$RESY_PASSWORD" \
| jq -r '.token // .id.token // .auth_token'

The api key above is Resy's public web-app key (baked into resy.com's own JS, not a secret — see src/client.ts). Save the returned token as $RESY_TOKEN.

Path B — no credentials, only a signed-in resy.com browser tab:

One-time setup:

npm install -g @fetchproxy/cli            # provides `fpx`
fpx profile add resy --domain resy.com
fpx pair -p resy                          # prints a pair code → approve in Transporter

Then bootstrap the token through the tab (this replicates the one call resy.com's own JS makes to refresh its in-memory token — the HttpOnly session cookies authenticate it):

fpx post-json 'https://api.resy.com/3/auth/refresh' '{}' -p resy \
  | jq -r '.token'

Save it as $RESY_TOKEN. fpx is not used again after this — every call below is curl.

Step 2 — call the API directly with the token

Every authenticated request needs this header set (see SPOOF_HEADERS + buildHeaders in src/client.ts):