Partner API
Server-side access with two credential types — read-only API keys for your systems and scan-only device credentials for gates — with rate limits and IP controls.
The partner API is for your servers, not browsers: pull your
events, orders, and tickets into a dashboard or CRM, or let turnstile
hardware validate tickets. It lives at
https://api.bookitive.com/partner/v1, with an interactive reference at
…/partner/v1/docs.
Two credential classes, dispatched by the secret's prefix:
API keys (bk_live_…) — read-only
Created under Settings → API keys. A key is read-only across your organization and can call:
/organization,/events,/events/{eventId},/events/{eventId}/tickets,/orders,/orders/{orderId}.
Rate limit: 120 requests/minute per key. The full secret is shown once at creation — store it server-side; Bookitive keeps only a hash and a short fingerprint for the UI. Owners and admins are emailed when a key is created, because a new read-all credential is a security event.
curl https://api.bookitive.com/partner/v1/events \
-H "Authorization: Bearer bk_live_…"Scanner devices (bk_scan_…) — scan-only
Created under Settings → API keys too (the scanner devices card), and documented from the door's perspective in Scanner devices. A device credential can do exactly one thing:
POST /events/{eventId}/scan— submit a scanned code, get a verdict.
No read access at all — a compromised gate can't leak your attendee list. Rate limit: 240 requests/minute per device, and an optional CIDR allowlist so the secret only works from the gate's own network.
Security model
- Never put a partner key in a browser — it reads across your whole organization. The widget and JS client exist precisely so front-end code uses the credential-free public API instead.
- Authentication failures return an opaque 401 — the message differs only by credential type ("invalid or revoked API key" vs the device credential wording), never revealing whether a given key exists.
- Revoking either credential cuts it off immediately.
Page sizes are clamped, not rejected — ask for more than the maximum and you get the maximum, not an error. Paginate with the cursor the responses return rather than assuming you got everything in one call.
Related
JS client
The @bookitive/js typed client for building your own checkout — reads, placing orders, phone verification, waitlist, live seat updates, and typed errors.
Webhooks
Get your systems pushed to when things happen — the subscribable events, the signed request format, the retry ladder and auto-disable, and the test event.