API Keys

An API key lets a script, an internal system or an automation tool call the Booked55 API without signing in. For ChatGPT or Claude, connect through the MCP server with OAuth instead, which lets you choose what the app may do.

Who can manage API keys

Owners and managers. Other roles don't see API Keys in the sidebar and the API refuses them. Your organization also needs an active subscription.

Creating an API key

1. 1

   Open API Keys

   In the sidebar, go to Workspace → Workspace Settings → Advanced → API Keys. Only owners and managers see this page.

2. 2

   Click "Create API Key"

   The Create API Key window opens.

3. 3

   Name the key

   Enter a Key Name that says what uses it, for example "Zapier" or "Nightly export script". Add a Description if it helps.

4. 4

   Set an Expiration Date

   Pick the date the key should stop working. It stops at the end of that day (UTC). Leave it empty only if you will delete the key yourself.

5. 5

   Click "Create Key" and copy it

   The API Key Created window shows the full key once. Click Copy, store it somewhere safe such as a password manager, then click Done. You cannot see the full key again.

The Read, Write and Delete boxes

The Create API Key window has a Permissions section with Read, Write and Delete. Today these are labels only: a key ticked “Read” can still create, change and delete data, because every request made with a key runs with its creator's role. Don't hand a key to a third party on the understanding that it is read-only.

What a key can never do

A key works with your organization's data. It cannot act on anyone's sign-in or on other credentials, whoever created it:

• Change a password.
• See sessions, end a session, or sign anyone out everywhere.
• Set up, check or turn off two-factor authentication, or read its backup codes.
• Create, list or delete API keys.
• List or disconnect connected AI apps.

The API answers each of these with 403 and the code interactive_session_required. They are done by a person, signed in to Booked55.

Using a key

Keys start with vg_. Send the key in the Authorization header of each request to https://api.booked55.com:

The API Keys page shows the same example in cURL, Python and JavaScript. See the API reference for every endpoint.

Managing and deleting keys

API keys belong to the person who created them. The API Keys page lists only your own keys in this organization, with each key's Name, a short preview of the Key, Last Used and Created. You can't see or delete a teammate's keys, and they can't see yours.

• Delete a key — Click the trash icon on its row, then Delete in the Delete API Key window. Anything using that key stops working straight away. This cannot be undone.
• Replace a key — Keys can't be edited or regenerated. Create a new key, switch your integration to it, then delete the old one.
• Review your keys regularly — Last Used shows the date Booked55 last accepted the key on a request. It is recorded at most once every 5 minutes per key, and a request refused because the key has expired doesn't count. Delete any key you can't match to a system that still uses it; a key that shows Never, or hasn't been used in months, is the place to start.
• When someone leaves — A key follows its creator's membership. If they are removed from the organization, their keys stop working. If their role changes, their keys get the new role's access.

API keys and the AI assistant

The in-app AI assistant can explain API keys, but it cannot see, create or delete them, and it will never ask you for one. It gives you the link to this page instead. See What the AI assistant can do.