Skip to main content

API keys and external system access

The API keys screen is the actual place where you manage API access for external systems.

When to use this page​

  • when a CRM, website, mobile app, or another external system needs API access to your data;
  • when you want to give different access levels to different external systems;
  • when you need to stop, limit, or remove existing API access.

Access​

  1. Open Integrations.
  2. Select API keys.

What you see in the list​

  • Name
  • Expires at (or Never)
  • Active
  • Actions: Edit API key, Delete API key

Create a new key​

  1. Select New API Key.
  2. Fill in Name (required), Expires at (optional), Active, and Select permissions.
  3. Select Create.
  4. Securely store the displayed token and provide it to the external system.

What each field means​

  • Name is your internal label for the key.
  • Expires at defines when the key should stop working. If left empty, the key has no expiration.
  • Active lets you stop or allow access without deleting the key.
  • Select permissions defines which resources and actions will be available through this key.

How permissions work​

  • Permissions are selected separately for each key.
  • The key can access only the resources and actions you have allowed.
  • Each permission carries a short description of what it allows.
  • If access should be more limited, create a separate key with fewer permissions.

Permissions that change your calendar​

Three permissions let the external system change appointments that already exist. Each one carries a short description on the screen — what follows is the consequences that do not fit there:

  • Reschedule appointments works for single appointments only. Group appointments, and appointments that have already started or passed, are refused. Scheduled reminders move to the new time, but the client does not automatically get an "appointment changed" notification — in the Business app that is a separate choice when saving, and the API offers no such choice.
  • Change participant status (cancel / no-show) applies to the individual person, not to the whole group. It can set any of your business's statuses, including your own custom ones — not only the three in the permission name. Cancelling in a group automatically promotes a client from the waiting list into the freed seat.
  • Delete appointments removes the appointment from the calendar entirely.
warning

Grant these only to a system you trust to manage your calendar. A deleted appointment cannot be restored from the Business app. For a cancellation that stays visible in the history, use the participant status permission instead of deletion.

Changing the number of seats in a group appointment is not available through the API.

Permissions for client data​

  • View clients list allows searching your entire client list — by phone, email, external number or part of a name.
  • View client opens an individual client profile.
warning

The appointment permissions also expose client data. A key holding only View appointments list sees the clients on those appointments, without you having granted it the client permissions.

Phone and email are shown partially masked everywhere. Full contact details are revealed only if you also grant View sensitive information from the Clients group.

This is a decision about your clients' personal data, not a technical detail.

Notifications and wallet​

Actions performed through the API send the client the same notifications that the same actions send from the Business app, according to your settings for channels and notification types — deletion included.

One exception: rescheduling sends no automatic "appointment changed" notification (see above).

Paid channels (SMS, Viber) draw from the business wallet. When the balance runs out the channel is skipped and the notification is not sent through it.

How to manage an existing key​

  • use Edit API key when you need to change the name, expiration, status, or permissions;
  • disable Active if you want to stop access temporarily;
  • use Delete API key if the integration no longer needs access.
warning

For keys created before the separate availability permission was introduced, the checkbox is already ticked. Unticking it stops the external system from receiving available slots and breaks the integration.

How API access works​

  • The external system uses the token as Authorization: Bearer <api-key>.
  • Access depends on the key being active, not expired, and having the required permissions.
  • The business must also have the external_connectivity feature active in its subscription.

What is available in the current product​

  • JSON:API v2 supports API key access.
  • The public v2 specification documents resources such as services, available slots, appointments (viewing, creating, cancelling, rescheduling, and deleting), clients (lookup by phone, email, or keywords), working hours, installments, and payments.
  • If external_connectivity is not active, some requests can return 402 Payment Required.

Critical security note​

  • After creation, the system shows API Access token in a dedicated modal.
  • This token is shown once only. After closing the modal, it cannot be viewed again.
  • Store the token securely and do not share it.

What is not available in the current UI​

  • Logs is present in the menu but currently disabled in the UI.
  • If you edit an existing key, the system does not show the previous token again. The token display is only part of creation.
  • There is no dedicated webhook setup screen in the Business UI.
💡No business profile yet?

To use these features in Business, you need a business profile. Create one and continue with setup.