> ## Documentation Index
> Fetch the complete documentation index at: https://opencals.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# API Reference

> Base URL, authentication, and conventions for the Opencals Storefront API — plus an interactive playground for every endpoint.

The Storefront API is a REST API for building custom booking experiences: services, real-time availability, staff members, locations, carts, checkout, payments, and customer self-service.

## Base URL

```text theme={"theme":{"light":"github-light","dark":"github-dark-default"}}
https://api.opencals.com
```

All endpoint paths are prefixed with `/storefront`. Responses are JSON with camelCase property names, and all date/time values are UTC.

## Authentication

Every request requires a Storefront API key in the `X-Api-Key` header:

```bash theme={"theme":{"light":"github-light","dark":"github-dark-default"}}
curl "https://api.opencals.com/storefront/products" \
  -H "X-Api-Key: sfk_your_api_key"
```

Keys are scoped to a single store and start with `sfk_`. Create one in the dashboard under **Settings → API Keys** — or [contact us](https://opencals.com/contact) if you don't have an account yet and want to evaluate the API.

Customer-scoped endpoints (appointments, orders, profile) additionally require a customer JWT as a Bearer token — see the [Authentication guide](/docs/authentication) for the full token flow.

<Note>
  Every endpoint page in this reference includes an **interactive playground**: paste your `sfk_` key into the authorization field, fill in the parameters, and send real requests against your store directly from the docs.
</Note>

## Conventions

* **Pagination** — list endpoints accept `page` (1-indexed) and `take` (max 100) and return a `meta` object with `itemCount`, `pageCount`, `hasPreviousPage`, and `hasNextPage`.
* **Carts** — cart and checkout endpoints identify the active cart with the `X-Cart-Id` header.
* **Errors** — conventional HTTP status codes with a JSON body; `400` responses include a per-field `errors` array. See [error responses](/docs/authentication#error-responses).
* **Rate limits** — 100 requests / 60 seconds for general endpoints, stricter limits on auth flows. See [rate limits](/docs/quickstart#rate-limits).