API keys, webhooks and calendar feeds

Calendar feeds — the one everybody wants

This one needs no technical knowledge at all. Make a feed for your shifts, the club's events or your tee times, and paste the link into Apple Calendar, Google Calendar or Outlook as a subscription. It's read-only, it only ever shows your own rows, and you can revoke it whenever you like.

API keys

1. 1Open API & feeds as an owner and create a key, naming what it's for.
2. 2Decide whether it needs write access. Most things only need read.
3. 3Copy it now — we store only a hash, so it can never be shown again. Lost one is a new one.
4. 4Send it as an Authorization header: Bearer, then the key.

Calling /api/v1 with a key returns the list of everything that key can reach — jobs, crew, shifts, tee times, members, events and equipment. Six hundred calls an hour; over that you get a refusal rather than a surprise bill.

Webhooks

Point a URL at us and we'll send it a message when something happens: a tee time booked or cancelled, a job completed, a schedule published, a member joined, an invoice paid, an event sign-up, an order placed, or a machine marked down.

When a webhook fails

We retry. If it keeps failing, the webhook is paused and the failure is shown on the screen with the response we got, rather than being dropped silently. The last twenty-five delivery attempts are listed whatever their outcome.

What we won't accept

A webhook URL has to be https and has to be a real, publicly reachable address. Anything pointing at a private network, a loopback address or a cloud metadata service is refused with a reason.