HomeBook an Intro CallStartup Program
Documentation

OnSched.js

Public booking widgets call /v3/public/* with a public client ID and a matching Allowed Domain.

Purpose

Customer-facing booking pages do not use OAuth client secrets. They call /v3/public/* with:

  • Header x-client-id (public client ID from the dashboard)
  • Browser Origin that matches an Allowed Domain for that company

See Authentication for the public flow. Scripted callers without Origin receive 403.

Public routes

All of these require x-client-id and a matching Origin:

MethodPath
GET/v3/public/availability
GET/v3/public/locations, /v3/public/location/:id
GET/v3/public/services, /v3/public/service/:id
GET/v3/public/resources, /v3/public/resource/:id
GET/v3/public/appointments, /v3/public/appointment/:id
POST/v3/public/appointment, /v3/public/appointment/hold, /v3/public/appointment/reserve
PUT/v3/public/appointment/:id/book

Public responses omit merchant-only fields (notes, many custom fields, contact details). Use a machine token or dashboard token on /v3/* for operator tooling.

Hosts

Production https://v3.onsched.com, staging https://api-stage.onsched.com. See Environments.

See also

Updated 1 day ago

Did this page help you?