A local welcome. A wider view.

An authorized seller access token; OAuth is the documented route for a third-party application. Request the endpoint's appointment or order scopes and map the correct location, bookable service and team member. Buyer-level appointment operations are available to all sellers, with control limited to application-created bookings. Seller-level writes need Appointments Plus or Premium and APPOINTMENTS_ALL_WRITE as well as APPOINTMENTS_WRITE. Check support_seller_level_writes first. Orders retrieval requires ORDERS_READ; payment processing and non-Square-payment order fees are separate.

Current API uses an organization-scoped X-Api-Key plus the account subdomain header and JSON:API headers. Generate approved keys in the Gingr admin dashboard. Legacy account-specific /api/v1 calls use a user-specific key and a different contract. Account/key permissions, configured services and location rules apply. Public docs do not establish a universal subscription entitlement or price; confirm these with Gingr. Do not mix current and legacy endpoints. Booking validation and any manual staff confirmation must be respected.

Bearer service key with object-specific read/write scopes, created by a Super Admin or a user with Developer tools access. A developer-platform app with static or OAuth access is another route. Use scopes and CRM objects available in the customer's account. Service keys make REST requests but cannot authenticate webhooks. Existing legacy private apps remain supported; creating a new legacy private app ended October 26, 2026. Use the current service-key or developer-platform flow.