Connect your tools with the API
The API lets a third-party application access your club data programmatically: member lists, calendars, bookings, and billing. You can enable it in two clicks. It is protected by a key, a list of authorized addresses, and usage tracking.
Find out whether the API is relevant to you
The API is intended for a developer, not for a club manager. It is used to connect your account with software that you have developed or configured: a custom website, an accounting tool, an in-house display screen, or a gateway to another system.
For common needs — retrieving the member list, updating subscriptions in bulk, or sending figures to the board — the import, export, and report modules meet these needs without writing a single line of code.
The API is provided as a beta version. Its behavior may still change.
Enable the API and retrieve your key
- Go to Administration›Settings›API BETA.
- Enable Activate the API module. Then click Save.
- Your API Key is displayed. Copy it using the Copy button and share it only with the tool you are connecting.
The key must be sent in the X-API-Key HTTP header of each request. Calls must be made over HTTPS. Unencrypted requests are not accepted.
Protect the key
It is worth reminding the tool or service provider using it of a few best practices:
- never commit the key to a code repository; store it in a configuration file outside the repository or in a secrets manager;
- restrict authorized addresses as soon as the tool calls from a fixed server;
- regenerate the key if you have the slightest doubt — accidental publication, log leak, or the end of a service provider’s assignment.
The Regenerate button asks for confirmation. It then immediately invalidates the old key. All applications that used it stop working until they receive the new one. Notify them before clicking.
Restrict access by IP address
Enable Restriction by IP address. Only requests from the addresses you list are accepted, up to a limit of 10 IPv4 addresses. Enter each address and confirm with Add. Your current address is displayed on screen to help you.
This is the most effective protection, and the one most often overlooked. Even if disclosed, a key restricted to your service provider’s address remains unusable elsewhere.
Monitor usage
The screen continuously displays what your key is consuming:
- Usage this minute and Usage today, each shown against its limit when a limit is configured;
- Usage Statistics: This week, This month, Total, and Last request.
Above the indicated limits, additional requests are temporarily refused. A counter that constantly approaches its limit generally indicates a poorly configured tool. It is requesting the same data repeatedly instead of caching it.
The last request date is useful in the opposite case. A key that is enabled but has not been called for months should be disabled.
Discover what the API can do
The full documentation, including parameters and call examples, is displayed at the bottom of the module screen. In broad terms:
- Users: this is the only editable resource. You can list, view, create, edit, and delete accounts.
- Configuration: subscriptions, profiles, groups, and age categories can be viewed, but they can only be configured from the application.
- Booking: calendars, available time slots, bookings, and labels can be viewed.
- Billing: billing accounts, orders, and payments can be viewed.
