Skip to main content
The Storefront API is a REST API for building custom booking experiences: services, real-time availability, staff members, locations, carts, checkout, payments, and customer self-service.

​
Base URL

All endpoint paths are prefixed with /storefront. Responses are JSON with camelCase property names, and all date/time values are UTC.

​
Authentication

Every request requires a Storefront API key in the X-Api-Key header:
Keys are scoped to a single store: a private key (spk_) for server code, a public key (sfk_) for browser code (see API keys). Create one in the dashboard under Users → your user → API Keys, or contact us if you don’t have an account yet and want to evaluate the API. Customer-scoped endpoints (appointments, orders, profile) additionally require a customer JWT as a Bearer token — see the Authentication guide for the full token flow.
Every endpoint page in this reference includes an interactive playground: paste a public sfk_ key into the authorization field, fill in the parameters, and send real requests against your store directly from the docs. The playground runs in your browser, so a private spk_ key is rejected there.

​
Conventions

  • Pagination — list endpoints accept page (1-indexed) and take (max 100) and return a meta object with itemCount, pageCount, hasPreviousPage, and hasNextPage.
  • Carts — cart and checkout endpoints identify the active cart with the X-Cart-Id header.
  • Errors — conventional HTTP status codes with a JSON body; 400 responses include a per-field errors array. See error responses.
  • Rate limits — per API key and visitor IP: 50 requests / second and 1,200 / minute for general endpoints, per-email and per-IP limits on sign-up, sign-in and email flows. See rate limits.
Last modified on October 24, 2026