---
title: "Enable API"
slug: "enable-api"
updated: 2026-10-14T07:14:29Z
published: 2026-10-14T07:14:29Z
canonical: "support.bookingtimes.com/enable-api"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://support.bookingtimes.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Enable API

BookingTimes API keys let external systems, such as your phone system or your own reporting app, call the BookingTimes API for your business. Each key has a name and one or more scopes, and it can only call the endpoints its scopes allow. A key is not tied to a staff member, so staff permissions and location restrictions do not apply to it: it reaches every location's and staff member's data its scopes cover.

## Who can create API keys

API keys are managed on **Setup > External Integrations**, which is available to staff whose role has the **Account Settings** permission. The `report.income` scope is only offered to staff whose role also has the **Financial Reports** permission. You can check and change both under **Setup > Manage Permissions**.

![Role Permissions with Account Settings and Financial Reports highlighted](https://cdn.document360.io/6926c75e-9b20-4216-bf9f-d7ca1df9c74f/Images/Setting/api-key-role-permissions.png)

## Create an API key

1. On your BookingTimes website, go to **Setup** and click **External Integrations**.

![External Integrations on the Setup page](https://cdn.document360.io/6926c75e-9b20-4216-bf9f-d7ca1df9c74f/Images/Setting/api-key-setup-external-integrations.png)
2. Under **BookingTimes**, click **Create API Key**.
3. Enter a **Name** that says what the key is for (for example "Reporting app"), tick the scopes it needs, and click **Create Key**. Only tick what the integration uses.

![Create API Key with the report.income scope ticked](https://cdn.document360.io/6926c75e-9b20-4216-bf9f-d7ca1df9c74f/Images/Setting/api-key-create-api-key.png)
4. Copy the key using the copy button. **IMPORTANT: The key is only shown once, so save it somewhere safe straight away.** Treat it like a password.

![API Key Created, showing the key once](https://cdn.document360.io/6926c75e-9b20-4216-bf9f-d7ca1df9c74f/Images/Setting/api-key-api-key-created.png)
5. The key now appears in the **API Keys** list with its name, the start of the key, its scopes, when it was created and when it was last used.

![The API Keys list showing the new key](https://cdn.document360.io/6926c75e-9b20-4216-bf9f-d7ca1df9c74f/Images/Setting/api-key-api-keys-list.png)

If you enabled API access before October 2026, your existing key is listed as **Default** and keeps working with the scopes it already had.

## Scopes

| Scope | What it allows | Article |
| --- | --- | --- |
| `booking.confirm` | Confirm bookings |  |
| `booking.attended` | Mark bookings attended |  |
| `client.phonelookup` | Look up a caller's name by phone number | [API Get Caller](/v2/docs/api-get-caller) |
| `client.unsubscribe` | Unsubscribe clients from marketing | [API Unsubscribe](/v2/docs/api-unsubscribe) |
| `report.income` | Read the income report (all locations, including client names and payment details) | [API Income Report](/v2/docs/api-income-report) |

## Use the key

Send the key in an `x-api-key` header on every request, to your own BookingTimes website address (for example `https://examplebusiness.com/Api/v1/...`). A request with no key is refused with `400`, a wrong or revoked key with `401`, and a key without the endpoint's scope with `403`.

## Revoke a key

Revoke a key when the integration is no longer used, or straight away if the key may have been exposed.

1. Go to **Setup > External Integrations**.
2. In the **API Keys** list, click **Revoke** next to the key, then click **Revoke** to confirm.

![Revoke API Key confirmation](https://cdn.document360.io/6926c75e-9b20-4216-bf9f-d7ca1df9c74f/Images/Setting/api-key-revoke-api-key.png)

Integrations using the key stop working straight away, and this cannot be undone. Revoked keys are hidden from the list; click **Show Revoked Keys** to see them.

## Lost a key?

A key cannot be shown again after it is created. Create a new key with the same scopes, update your integration to use it, then revoke the old one.