API keys and REST API
Create a secret key and use the version 1 API for bookings, event types, availability, and webhooks.
API access requires Pro. Open API Keys, give the key a name, and create it. The full secret is shown once. Store it in a password manager or secret store; Magpie cannot show it again. Revoking a key stops it immediately.
Send the key in every request:
Authorization: Bearer YOUR_SECRET_KEY
The base path is /api/v1. The API provides list, create, read, update, confirm,
cancel, archive, and delete operations for bookings as applicable; create and
management operations for event types and availability; the signed-in user
record; and webhook subscriptions. Open /docs/api for the complete resource,
field, status, and error reference before building a client.
Webhook deliveries include X-Magpie-Event, X-Magpie-Id,
X-Magpie-Timestamp, and X-Magpie-Signature. Verify the timestamp and HMAC
signature before processing the body. Store the delivery ID so a retry is not
applied twice.
Never put a secret key in browser JavaScript, a public repository, or a URL. If a key may have been exposed, revoke it and make another. For an API response or signature that does not match the reference, Contact support.