Snipes a table at Sarma — 249 Pearl St, Somerville MA — via Resy.

Restaurant	Sarma · resy.com/cities/bos/sarma (venue id 4795)
Date	Sunday, October 18, 2026
Time	5:00–6:00 PM — either seating is fine
Party	5

All of that lives in config.ts. Change it there, not in the cron file.

Sarma releases one new day each morning at 10:00 AM Eastern, exactly 30 days ahead — not a monthly batch, and the good slots go in seconds.

Oct 18 enters that window on Friday, September 18, 2026 at 10:00 AM ET. That's the drop.

cron.ts runs */5 14 * * * — every 5 minutes from 10:00–10:55 AM ET (14:00–14:55 UTC). The 10:00 run retries for ~90 seconds so it can grab the day the instant it appears; the later runs are for stragglers and cancellations.

Rendering mermaid diagram...

Resy's web sign-in is one-time-code based — email or SMS — so there's usually no password to hand a bot. Instead the bot uses the x-resy-auth-token that Resy issues to your logged-in browser session. It's a JWT, valid for about 45 days.

To grab it:

1. Log into resy.com in a desktop browser.
2. Open DevTools → Network tab.
3. Reload the page, and filter the requests for api.resy.com.
4. Click any one of them and find the request header x-resy-auth-token.
5. Copy the whole value — it's a long eyJ… string — and save it as the resyToken environment variable.

Not in localStorage — Resy keeps the session in HttpOnly cookies, so the Network tab is the place to look.

Resy won't confirm a reservation without a payment method. Add one at resy.com/account/payment-methods, or the bot will stop with no payment methods on account.

Fallback: resyEmail + resyPassword still work via POST /3/auth/password — but only if your Resy account actually has a password set on it, which most don't any more.

File	What it is
config.ts	What to book — slug, city, date, time window, party size
cron.ts	The scheduled sniper
check.ts	Dry run — walks the whole chain without booking
resy-auth.ts	Token/password auth + payment method lookup
main.tsx	The resyBot library

Run check.ts from the editor. It reports, in order:

• the resolved venue id
• whether your token is accepted
• whether there's a card on file, and which id it'll use
• every slot currently bookable on the target date

Do this before 10 AM ET on Sept 18. If the token or the payment method is wrong, you want to find out now rather than at the drop. Before the drop it should print zero slots; afterwards it should list the evening's seatings.

The bot emails you (and Resy will too) the moment it books. Once a table is secured it writes a marker to blob storage and every later run exits immediately, so it won't double-book. To retarget it at a different date, edit config.ts — that also resets the duplicate guard.

• Resy has no public API. This drives the same private endpoints the web app calls, so it can break whenever Resy changes them.
• Resy returns slot times in the restaurant's local time, so start/end in config.ts are Somerville local times (17:00 = 5 PM ET).
• A party of 5 is meaningfully harder to get than a 2-top — Sarma has few large tables. Widening the time window is the cheapest way to improve the odds.
• Tokens expire after ~45 days. If check.ts reports a 401/419, copy a fresh x-resy-auth-token.
• Credit to @stevekrouse / @struong for the original resyBot, and @rlesser / @alp for the Resy vals it grew from.