Authentication
Create a Bridge API key, choose read only or read and write access, and send the key with every request.
Every request to the Bridge API needs an API key. Keys belong to a workspace and are created by workspace owners.
API keys are available to workspaces on the Business and Enterprise plans. Only workspace owners can see and manage them.
Create an API key
Open API keys
In Bridge, go to Settings → API keys.
Create the key
Click Create API key, give it a name you'll recognise later (for example "CRM sync"), and choose its access.
Copy it now
Copy the key and store it somewhere safe, such as your server's secret manager. Bridge shows the full key only once. If you lose it, revoke it and create a new one.
Choose the access
| Access | What the key can do |
|---|---|
| Read only | Read booking pages, collections, open times and bookings, including intake answers. |
| Read and write | Everything above, plus create, update and delete booking pages, and book, reschedule and cancel meetings. |
Use read only keys for anything that only needs to sync data out of Bridge. A read only key gets a 403 error if it tries to change something.
Send the key
Send the key in the Authorization header as a bearer token:
curl https://api.meetonbridge.com/v1/me \
-H "Authorization: Bearer $BRIDGE_API_KEY"
GET /me is a quick way to check a key. It returns the key's name and access, the person it acts as, and the workspace.
What a key can see and do
A key acts as the workspace owner who created it. It can do what that person can do in Bridge, and nothing more:
- Bookings: an owner's key sees every booking in the workspace.
- Booking pages: the key sees the booking pages its owner can see in Bridge.
- Rescheduling and cancelling: the key can change bookings its owner hosts, and bookings on booking pages shared with the workspace.
A key stops working if the person who created it is no longer an owner of the workspace, or if the workspace moves to a plan without the API.
Keep keys safe
- Use keys only from your server. Don't put them in browser or mobile app code, where anyone can read them.
- Give each integration its own key, so you can revoke one without breaking the others.
- Settings → API keys shows when each key was last used, which helps you find keys nobody uses any more.
Revoke a key
In Settings → API keys, click Revoke next to the key and confirm. Anything using the key stops working right away. This can't be undone.
Authentication errors
| Status | Code | When it happens |
|---|---|---|
401 | unauthorized | The Authorization header is missing, or the key is invalid or revoked. |
403 | forbidden | The key is read only and the request changes something, the key's creator is no longer an owner, or the workspace's plan doesn't include the API. |