Build on SendLynx

Overview

The SendLynx API lets your platform read and manage a business's scheduling data after that business explicitly authorizes you. Access is scoped per business: you only ever touch the data of businesses that connected your app.

Connecting an app is a SendLynx Studio feature. If a connected business later drops below Studio, its tokens stop refreshing and API access lapses within an hour (403 access_denied); it resumes automatically if they upgrade again within 30 days. After that the refresh token itself expires and the business re-authorizes your app once.

1. Redirect the business owner to SendLynx to log in and approve your app.
2. SendLynx redirects back with a one-time code.
3. Your server exchanges the code for an access token + refresh token.
4. You call /api/v1/* with the access token.
5. SendLynx sends you signed webhooks as bookings and payments change.

Discovery metadata: https://sendlynx.com/.well-known/oauth-authorization-server

Quickstart

Apps are created in two ways: self-serve from your dashboard (Developers → Create app) or by the SendLynx team for partners. Either way you get a client_id, a client_secret (shown once), your scopes, and an optional webhook_secret. The flow is Authorization Code with PKCE (S256, required); keep your client_secret server-side.

Authentication

Generate a PKCE verifier/challenge and send the owner's browser to:

https://sendlynx.com/oauth/authorize
  ?response_type=code
  &client_id=YOUR_CLIENT_ID
  &redirect_uri=https://yourapp.com/oauth/callback
  &scope=availability:read bookings:read bookings:write clients:write
  &state=RANDOM_CSRF_STRING
  &code_challenge=BASE64URL_SHA256_OF_VERIFIER
  &code_challenge_method=S256

The owner approves; SendLynx redirects to your redirect_uri with ?code=...&state=... (the redirect_uri must exactly match a registered one). Exchange the code:

curl -X POST https://sendlynx.com/api/oauth/token \
  -u YOUR_CLIENT_ID:YOUR_CLIENT_SECRET \
  -d grant_type=authorization_code \
  -d code=THE_CODE \
  -d redirect_uri=https://yourapp.com/oauth/callback \
  -d code_verifier=YOUR_PKCE_VERIFIER

# → { "access_token": "...", "token_type": "Bearer",
#     "expires_in": 3600, "refresh_token": "...", "scope": "..." }

Access tokens last 1 hour. Refresh tokens last 30 days and rotate on every use, so store the newest one. Replaying an old refresh token revokes the whole authorization.

curl -X POST https://sendlynx.com/api/oauth/token \
  -u YOUR_CLIENT_ID:YOUR_CLIENT_SECRET \
  -d grant_type=refresh_token \
  -d refresh_token=THE_REFRESH_TOKEN

Scopes

API console

Once you're logged in on a Studio (or trial) account, you can run real API calls against your own business data right in the browser: pick an endpoint, edit the params, and hit Send.

Open the API console →

Endpoints

Base URL https://sendlynx.com/api/v1. Pass the access token as Authorization: Bearer …. List endpoints are cursor-paginated (?limit= max 100, ?cursor=) and return { data, next_cursor, has_more }. Send an Idempotency-Key header on POST /bookings so retries never double-book (other endpoints don't honor the header yet).

{
  "name": "Men's Haircut",
  "description": "Classic cut and style.",
  "durationMin": 30,
  "priceCents": 5000,
  "depositCents": 1000,
  "paymentMode": "deposit",
  "bufferMin": 5,
  "active": true,
  "rebookEnabled": true,
  "rebookIntervalDays": 28
}

{
  "priceCents": 5500,
  "active": true
}

{
  "name": "Jordan Smith",
  "email": "jordan@example.com",
  "bio": "Senior stylist",
  "active": true,
  "serviceIds": []
}

{
  "name": "Jordan A. Smith",
  "active": true
}

{
  "serviceId": "REPLACE_WITH_SERVICE_ID",
  "staffId": "any",
  "startUtc": "2026-06-20T15:00:00Z",
  "customer": {
    "name": "Jane Doe",
    "phone": "+15551234567"
  },
  "additionalServiceIds": [],
  "addOnIds": [],
  "smsConsent": true,
  "notify": true,
  "serviceAddress": "12 Main St",
  "notes": "Leaky faucet"
}

{
  "startUtc": "2026-06-21T16:00:00Z"
}

{
  "reason": "Customer requested"
}

{
  "name": "Jane Doe",
  "email": "jane@example.com",
  "phone": "+15551234567",
  "smsConsent": false
}

{
  "name": "Jane A. Doe",
  "email": "jane@example.com",
  "phone": "+15559876543",
  "notes": "Prefers morning appointments."
}

{
  "url": "https://example.com/webhooks/sendlynx",
  "events": [
    "booking.created",
    "payment.received"
  ]
}

{
  "code": "123456"
}

{
  "code": "123456"
}

{
  "smsEnabled": true,
  "notifyOnPayment": true
}

Webhooks

Webhook subscriptions (REST hooks)

Subscribe any HTTPS endpoint to events with POST /api/v1/hooks (scope hooks:manage) — pass { url, events } and store the returned secret (shown once). Each event also requires its data scope on your grant: booking.created, booking.requested, booking.canceled and booking.rescheduled need bookings:read; payment.received needs payments:read; client.created needs clients:read. Subscriptions are bound to your app: narrowing your grant's scopes via re-consent narrows the feed immediately, and revoking the app stops it — a push never carries data the same grant could not read over /api/v1. Each delivery is a JSON envelope { id, event, createdAt, data } signed via the X-SendLynx-Signature header (same HMAC scheme as below). Unsubscribe with DELETE /api/v1/hooks/:id; get editor sample data from GET /api/v1/hooks/sample/:event. Ten consecutive delivery failures auto-disable a subscription (re-enable it from Developers → Webhooks). This is the surface our Slack alerts and custom endpoints ride on.

Partner-app webhooks

If your OAuth app has a webhook URL, SendLynx POSTs JSON events: booking.created, booking.rescheduled, booking.cancelled, booking.completed (scope bookings:read), payment.completed (scope payments:read) and client.opted_out / client.opted_in (scope clients:read). You only receive the events your grant's scopes cover — a push never carries data the same grant could not read over /api/v1, and narrowing scopes via re-consent stops the feed immediately. Delivery is at-least-once with retries, so dedupe on the Sendlynx-Event-Id header. Verify the signature before trusting an event:

const crypto = require("crypto");

function verifySendlynxWebhook(rawBody, signatureHeader, secret) {
  // header: "t=1718900000,v1=<hex>"
  const parts = Object.fromEntries(signatureHeader.split(",").map((p) => p.split("=")));
  const expected = crypto
    .createHmac("sha256", secret)
    .update(parts.t + "." + rawBody)
    .digest("hex");
  const ok = crypto.timingSafeEqual(Buffer.from(parts.v1), Buffer.from(expected));
  if (!ok) throw new Error("Invalid signature");
  if (Math.abs(Date.now() / 1000 - Number(parts.t)) > 300) throw new Error("Stale webhook");
  return JSON.parse(rawBody); // { id, type, created, business_id, data }
}

Errors

Errors are JSON: { "error": "code", "error_description": "..." }.

400  invalid_request        Malformed request / validation failed
401  invalid_token          Missing, expired, or revoked access token
403  insufficient_scope     Token lacks the required scope
403  access_denied          Business's plan no longer includes API access (Studio)
403  business_inactive      The business isn't taking bookings right now
404  not_found              Resource missing or not yours
409  slot_unavailable       That time was just taken
409  client_conflict        Customer already has an overlapping booking
422  group_booking_unsupported  Class/group services can't be booked via API yet
429  rate_limited           Slow down

Revocation

A business owner can revoke your app anytime from Settings → Connected apps; you can also revoke programmatically (RFC 7009):

curl -X POST https://sendlynx.com/api/oauth/revoke \
  -u YOUR_CLIENT_ID:YOUR_CLIENT_SECRET \
  -d token=THE_TOKEN

After revocation, all tokens for that business stop working immediately.