Overview
The BookingShake API uses Bearer token authentication to secure all endpoints. You’ll need to include your API key in theAuthorization header of every request.
Getting Your API Key
1
Log in to BookingShake
Access your BookingShake account at crm.bookingshake.com
2
Navigate to Settings
Click on Settings in the main navigation menu
3
Open Integrations
Select Integrations from the settings sidebar
4
Create an access token
In the API access tokens section, click New access token, give it a name (for example the application that will use it), then copy the token
Legacy venue key. Integrations built before September 2026 used the venue’s public form token as an API key. This key is deprecated: it is still accepted for now, but it will be refused after the migration period announced to affected customers. Create an access token as described above and replace the legacy key in your integration.
Authentication Method
Include your API key in theAuthorization header using the Bearer scheme:
Code Examples
Testing Authentication
You can quickly test your authentication by making a simple request to retrieve your booking sources:200 OK response with your booking sources.
Common Authentication Errors
400 Bad Request - 'missing token'
400 Bad Request - 'missing token'
Cause: The
Authorization header is missing from your request.Solution: Ensure you’re including the Authorization header with every request:400 Bad Request - 'invalid token'
400 Bad Request - 'invalid token'
Cause: The API key you provided is incorrect or has been revoked.Solution:
- Verify you copied the complete API key without extra spaces
- Check that you’re using the correct API key from Settings > Integrations
- Generate a new API key if the old one has been compromised
Security Best Practices
Use Environment Variables
Store API keys in environment variables, not in your source code.
Rotate Keys Regularly
Generate new API keys periodically and revoke old ones to minimize security risks.
Server-Side Only
Never expose API keys in client-side JavaScript or mobile apps. Make API calls from your backend server.
Monitor Usage
Regularly review API access logs to detect any unauthorized usage patterns.
Next Steps
Quickstart Guide
Make your first API request
Create Events
Start creating bookings via the API
