Managing API Secret Keys

The REST API lets your own systems read and write appointments, clients, services and team members in Appointible. Every request authenticates with a secret key that you create in Settings. This article covers creating a key, copying it during its one-time reveal, and revoking it.

Secret keys are managed by team members with settings access. Treat a key like a password: it gives admin access to your business over the API: everything except billing.

Open the API page

1. Log in to Appointible.
2. Open Settings > Integrations > API.

The page starts with the facts you need before your first request – the base URL, the Request header to send (Authorization: Bearer …), the format (JSON over HTTPS) and where the OpenAPI schema is published. Click Open API documentation for the full reference. Below that, Secret keys lists every active key with its name, a masked version of the key and when it was created.

Create a secret key

1. Click Create secret key.
2. Enter a Name. It is only for telling keys apart in the list – name it after the system that will use it, for example Booking site.
3. Click Create key.
4. Click the copy button next to the key and paste it straight into the system that will use it.
5. Click Done.

The key is available in full only on this step. After you close the dialog, only its first characters and last four stay visible in the list, and nothing in Appointible can display it again. If you lose a key, revoke it and create a new one.

The key is masked on screen until you click Show – copying does not need it visible, and a masked key is safe from anyone looking over your shoulder. Hide masks it again. The copy button always copies the full key, whether it is shown or hidden.

Use the key

Send the key as a Bearer token in the Authorization header of every request:

Authorization: Bearer ap_live_…

A key belongs to your business only and acts with admin access to it, except billing. It cannot be used to reach another business's data.

Revoke a key

1. On the key's row, click Revoke.
2. Click Revoke key to confirm.

Revoking takes effect immediately: every request made with that key is rejected from then on, and the key leaves the list. Revoking cannot be undone – to restore access, create a new key and update the system that used the old one.

Revoke a key as soon as you suspect it has been exposed, for example if it was committed to a code repository or shared in a message. Create a replacement first if the system using it must not lose access.