Zentier
Get started

API reference

Authentication

Dashboard routes use your logged-in session. Public widget routes use a publishable or server secret API key.

API keys

Keys are created in Settings → API keys. v2 keys are stored hashed; legacy widget embed base keys remain encrypted at rest.

  • Publishable. prefix zentier_pk_live_ or zentier_pk_test_. Intended for browsers, embeds, and scoped headless clients.
  • Private key. prefix zentier_sk_live_ or zentier_sk_test_. Full access for trusted servers and Postman only; never expose to clients.
  • Legacy publishable. prefix zentier_publishable_ (v1 embed base keys still supported).

How to get a private key

Private keys are created in the dashboard at Settings → API keys. Click Private key. The key is shown once — copy it immediately into your backend .env or Postman api_key variable. Private keys grant full permissions and must never be used in frontend code.

Passing an API key (widget API)

Widget routes accept publishable and private keys in any of these forms:

  1. Header x-publishable-key: zentier_sk_live_… (recommended)
  2. Header Authorization: Bearer zentier_pk_live_…
  3. Query string ?key=zentier_publishable_… (simple for demos; watch referrer logs in production)
Example headers
x-publishable-key: zentier_publishable_xxxxxxxx

# or
Authorization: Bearer zentier_publishable_xxxxxxxx

Affected routes include widget availability, booking, config, and verify.

Dashboard API (session cookie)

Routes such as /api/resources, /api/bookings, /api/tenant, and /api/webhooks/subscriptions expect a valid Supabase session: the user must be signed in to your deployment (same site). Use cookies automatically with fetch from the browser, or forward session from your authenticated app if you integrate server-to-server differently.

No API key required for dashboard JSON

These handlers call getUser() on the server and resolve tenant_id from the users table. They are not designed for third-party anonymous access.

Scopes

v2 publishable keys use scopes such as widget:read, bookings:read, and bookings:write. Legacy v1 keys use availability:read for the same widget availability endpoints. Private keys bypass scope checks.