For the complete documentation index, see llms.txt.

Authentication

All Vennio API requests require authentication using a Bearer token in the Authorization header.

API keys

Vennio API keys are the recommended authentication method for server-side integrations and AI agents. Keys start with vennio_sk_live_ (secret) or vennio_pk_live_ (publishable).

Keep secret keys private

Secret keys (vennio_sk_live_*) should never be exposed in client-side code, browser JavaScript, or mobile apps. For client-side booking widgets, use a publishable key — it reaches only the public booking surface, so exposing it in a browser is safe.

Key types

Key type Prefix Use case Access
Secret key vennio_sk_live_ Server-side, AI agents Full access
Publishable key vennio_pk_live_ Client-side booking widgets Public booking surface only; domain-lockable

Creating a key

First API key? Use the dashboard

Create your first API key at vennio.app/api-keys. No API call required. Once you have a secret key, you can create additional keys programmatically using POST /v1/api-keys — pass your existing secret key as the Bearer token.

curl -X POST https://api.vennio.app/v1/api-keys \
  -H "Authorization: Bearer vennio_sk_live_YOUR_EXISTING_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "Production key",
    "description": "For my scheduling integration",
    "rate_limit_per_hour": 1000
  }'

{
  "api_key": {
    "id": "550e8400-e29b-41d4-a716-446655440000",
    "name": "Production key",
    "key": "vennio_sk_live_xxxxxxxxxxxxxxxxxxxx",
    "scopes": ["read", "write"],
    "rate_limit_per_hour": 1000,
    "created_at": "2026-01-20T10:00:00Z"
  }
}
Save your key immediately

The full key value is only shown once at creation. Store it securely — you won't be able to retrieve it again.

Using your key

Pass your API key as a Bearer token in every request:

curl https://api.vennio.app/v1/availability/slots \
  -H "Authorization: Bearer vennio_sk_live_YOUR_KEY_HERE" \
  -G \
  -d business_id=YOUR_BUSINESS_ID \
  -d duration_minutes=30 \
  -d from=2026-05-01T09:00:00Z \
  -d to=2026-05-01T17:00:00Z

What each key can reach

Secret keys and user sessions (JWT) have full access. A publishable key has no access beyond the public booking surface — the same endpoints an anonymous visitor to a booking page can reach: resolve a booking link, read its availability, create a booking, join a waitlist. It cannot create or manage links, hosts, consents, proposals, webhooks, or any account resource.

What it's for: embed it in client-side code and lock it to your domains. It identifies your account on the public booking surface — so bookings land against the right business — without carrying any power worth stealing. That's the point: safe in a browser, useful, and origin-restricted. Its value is operational:

Using a publishable key on any endpoint outside the public surface returns the standard problem+json 403:

{
  "type": "https://api.vennio.app/errors/forbidden",
  "title": "Forbidden",
  "status": 403,
  "detail": "This endpoint requires a secret API key. Publishable keys cannot access this resource. Use a secret key (vennio_sk_live_...) or a user session for server-side operations.",
  "request_id": "req_abc123"
}

Security best practices