API and webhooks
A REST API for your own systems and real-time event notifications.
API keys
Create a key under Embedding and API → API keys.
- Public key (pk_bko_…) is read-only, for example for showing availability in a browser.
- Secret key (sk_bko_…) is for servers: creating and cancelling bookings, and passes.
Send the key in the header Authorization: Bearer KEY. The API reference with examples is on For developers.
⚠️ The secret key is shown only once when it is created. Never put it in website code. If a key leaks, revoke it and create a new one.
Webhooks
Bookora sends events to the address you choose immediately: booking.created, booking.confirmed, booking.updated, booking.cancelled, pass.created, pass.renewed, pass.cancelled, access.granted and payment.received.
- Each request has the header x-bookora-event and the signature x-bookora-signature in the form t=timestamp,v1=HMAC-SHA256.
- The signature is calculated with the webhook secret from the string timestamp.body.
- A failed delivery is retried after 1, 5, 30, 120 and 720 minutes.
Didn't find an answer? Write to us at tuki@bookora.fi and we'll help. We usually reply the same working day.