Skip to content
Booking Engine API Docs

Secret keys vs. publishable keys, in plain terms

Your booking system uses two different kinds of keys, for two different jobs. Using the right one in the right place is the single most important safety habit for your integration.

Secret key

Section titled “Secret key”

This key lives only on your website’s own server — the part of your website your developer or agency controls, never the part a visitor’s browser can see. It can do everything we’ve allowed for your account: read a guest’s name, email, and phone number, create and cancel bookings, confirm a booking that was paid in cash, change your rates and prices.

You can also lock a secret key to the IP addresses of your server. Then a thief who copies the key cannot use it from anywhere else. See Getting your API keys.

Publishable key

Section titled “Publishable key”

This key is meant to be seen — it’s built into the small booking widget script that runs in a guest’s browser on your public website. Anyone who looks at your page’s source code can find it, and that’s fine by design.

It can only do four things: check availability (including the free times of a meeting room or studio), get a price, start a hold, and take a guest to a secure, Stripe-hosted payment page. It can never read a guest’s name, email, or phone number, and it can never move money or complete a booking on its own — even someone who copies this key straight off your page can’t do anything more with it than a normal visitor already could.

The key only works on the websites you list when you issue it. A request from any other website is refused.

The same key also powers the read-only calendar box — availability and price only, no booking flow — if you’d rather show your calendar than take bookings on a particular page.

Why this split matters to you

Section titled “Why this split matters to you”

This is what makes it safe to run our booking widget on your own website without needing your own security team. The key a visitor can see is deliberately limited to almost nothing; the key that can actually do anything sensitive never leaves your server.

If you’re not sure which one you need

Section titled “If you’re not sure which one you need”

If your developer or agency asks for “an API key” without saying which kind, ask them where it’s going:

  • Going into your website’s server code, somewhere a visitor’s browser never sees it? That’s a secret key.
  • Going into the booking widget snippet on your public page? That’s a publishable key.

If you’re still unsure, ask us before sending either one — it’s a normal question, not an inconvenience.

Next steps

Section titled “Next steps”