BookingTimes API keys let external systems, such as your phone system or your own reporting app, call the BookingTimes API for your business. Each key has a name and one or more scopes, and it can only call the endpoints its scopes allow. A key is not tied to a staff member, so staff permissions and location restrictions do not apply to it: it reaches every location's and staff member's data its scopes cover.
Who can create API keys
API keys are managed on Setup > External Integrations, which is available to staff whose role has the Account Settings permission. The report.income scope is only offered to staff whose role also has the Financial Reports permission. You can check and change both under Setup > Manage Permissions.
Create an API key
On your BookingTimes website, go to Setup and click External Integrations.
Under BookingTimes, click Create API Key.
Enter a Name that says what the key is for (for example "Reporting app"), tick the scopes it needs, and click Create Key. Only tick what the integration uses.
Copy the key using the copy button.
IMPORTANT: The key is only shown once, so save it somewhere safe straight away. Treat it like a password.
The key now appears in the API Keys list with its name, the start of the key, its scopes, when it was created and when it was last used.
If you enabled API access before October 2026, your existing key is listed as Default and keeps working with the scopes it already had.
Scopes
Scope | What it allows | Article |
|---|---|---|
| Confirm bookings | |
| Mark bookings attended | |
| Look up a caller's name by phone number | |
| Unsubscribe clients from marketing | |
| Read the income report (all locations, including client names and payment details) |
Use the key
Send the key in an x-api-key header on every request, to your own BookingTimes website address (for example https://examplebusiness.com/Api/v1/...). A request with no key is refused with 400, a wrong or revoked key with 401, and a key without the endpoint's scope with 403.
Revoke a key
Revoke a key when the integration is no longer used, or straight away if the key may have been exposed.
Go to Setup > External Integrations.
In the API Keys list, click Revoke next to the key, then click Revoke to confirm.
Integrations using the key stop working straight away, and this cannot be undone. Revoked keys are hidden from the list; click Show Revoked Keys to see them.
Lost a key?
A key cannot be shown again after it is created. Create a new key with the same scopes, update your integration to use it, then revoke the old one.