Developers Quickstart

Create an API key

In the admin dashboard, open the Developers panel and click New API Key. Give it a name (e.g. "Production"). The full key — it looks like tsp_… — is shown once. Copy it now and store it somewhere safe like a password manager or your server's secrets.

Make your first call

Send the key as a Bearer token on every request. List your meeting types to confirm it works:

curl (macOS / Linux / Git Bash)

curl https://www.teamschedulerpro.com/api/v1/meeting-types \
  -H "Authorization: Bearer tsp_your_key_here"

PowerShell (Windows)

$headers = @{ Authorization = "Bearer tsp_your_key_here" }
Invoke-RestMethod https://www.teamschedulerpro.com/api/v1/meeting-types -Headers $headers

Read availability, then book

Grab open slots for a meeting type, then create a booking. (Replace 15 with one of your meeting type IDs from step 2.)

Get availability

curl "https://www.teamschedulerpro.com/api/v1/meeting-types/15/availability?date=2026-06-10&timezone=America/New_York" \
  -H "Authorization: Bearer tsp_your_key_here"

Create a booking (no CAPTCHA needed with a key)

curl -X POST https://www.teamschedulerpro.com/api/bookings \
  -H "Authorization: Bearer tsp_your_key_here" -H "Content-Type: application/json" \
  -d '{
    "meetingTypeId": 15,
    "clientName": "Jane Doe",
    "clientEmail": "jane@example.com",
    "date": "2026-06-10",
    "time": "14:00",
    "timezone": "America/New_York"
  }'

The booking is created, the right team member's calendar gets the event, and confirmation emails go out — same as a booking made through the web page.

Add a webhook

Back in the Developers panel, under Webhooks, add the HTTPS URL on your server that should receive events and choose which to subscribe to:

• booking.created — a new booking was made
• booking.cancelled — a booking was cancelled

We POST a JSON body to your URL when those happen. Hit Send test to fire a sample delivery, then check the delivery log right there in the panel to see the response we got back.

Verify the signature

Every delivery carries X-TSP-Signature: sha256=<hmac> — an HMAC-SHA256 of the raw request body, keyed with your webhook's signing secret (shown in the panel). Always verify it before trusting a payload:

const crypto = require('crypto');

// IMPORTANT: use the raw, unparsed body — e.g. express.raw({ type: 'application/json' })
const expected = 'sha256=' + crypto
  .createHmac('sha256', WEBHOOK_SECRET)
  .update(rawBody)
  .digest('hex');

if (expected !== req.headers['x-tsp-signature']) {
  return res.sendStatus(401);
}
res.sendStatus(200); // any 2xx acknowledges

Respond with any 2xx to acknowledge. Non-2xx responses or timeouts are retried up to 3 times with backoff, and every attempt shows in the delivery log.