REST · JSON · v1

BKG.dk API

Read and change bookings, clients and the salon's catalogue from your own systems. API keys are made by the salon under Integrations; apps connect through a consent screen.

Download OpenAPI API keys →

Guides

Quick start

  1. In the admin: Integrations → API & webhooks → create a key with the access you need.
  2. Send it with every request as the X-API-Key header.
  3. Every answer is {"success", "data", "error", "code", "meta"}; lists page with meta.next_cursor.

Webhooks

Signed POSTs when bookings, clients, payments, reviews or gift cards change. Verify X-BKG-Signature-V2 (HMAC-SHA256 of "timestamp.body").

Apps

Partner apps use OAuth 2 with PKCE: /oauth/authorize → /api/v1/oauth/token. Tokens are short-lived and the salon can revoke them.

v1

Versioning: v1 only grows — fields and endpoints are added, never removed or changed. Anything that breaks gets a new version and at least 12 months' notice.

X-BKG-Signature-V2

import hashlib, hmac
from datetime import datetime, timezone

def verify(raw_body: bytes, headers, secret: str, max_age_s: int = 300) -> bool:
    ts = headers["X-BKG-Timestamp"]
    if abs((datetime.now(timezone.utc) - datetime.fromisoformat(ts)).total_seconds()) > max_age_s:
        return False
    expected = hmac.new(secret.encode(), f"{ts}.".encode() + raw_body, hashlib.sha256).hexdigest()
    sent = [headers.get("X-BKG-Signature-V2"), headers.get("X-BKG-Signature-V2-Previous")]
    return any(s and hmac.compare_digest(expected, s) for s in sent)
const crypto = require("crypto");

function verify(rawBody, headers, secret, maxAgeS = 300) {
  const ts = headers["x-bkg-timestamp"];
  if (Math.abs(Date.now() - Date.parse(ts)) / 1000 > maxAgeS) return false;
  const expected = crypto.createHmac("sha256", secret).update(`${ts}.${rawBody}`).digest("hex");
  return [headers["x-bkg-signature-v2"], headers["x-bkg-signature-v2-previous"]]
    .filter(Boolean)
    .some((s) => s.length === expected.length &&
      crypto.timingSafeEqual(Buffer.from(s), Buffer.from(expected)));
}
function bkg_verify(string $rawBody, array $headers, string $secret, int $maxAge = 300): bool {
    $ts = $headers['X-BKG-Timestamp'] ?? '';
    if (abs(time() - strtotime($ts)) > $maxAge) return false;
    $expected = hash_hmac('sha256', $ts . '.' . $rawBody, $secret);
    foreach (['X-BKG-Signature-V2', 'X-BKG-Signature-V2-Previous'] as $h) {
        if (!empty($headers[$h]) && hash_equals($expected, $headers[$h])) return true;
    }
    return false;
}

Loading the reference…

The reference could not be loaded.