Create API keys and webhooks
Create scoped API keys for the Nola REST API and send signed booking and payment events to your own endpoint, such as n8n or Zapier.
API keys let a script or automation read and write your data through the REST API. Webhooks push events to your server when something happens. Both live on Settings → Integrations.
Create an API key
- Open Settings → Integrations and scroll to API keys.
- Under New key, give the key a Name that says where it is used, for example "n8n workflow".
- Tick the Scopes the key needs. Pick at least one.
- Click Create.
- Copy the key from the green box straight away. It starts with
oh_live_and is shown only once.
Send it with every request as Authorization: Bearer oh_live_…. Endpoints, request bodies and examples are in the REST API reference.
| Scope | Checkbox | Allows |
|---|---|---|
bookings:read | Bookings, read | List bookings |
bookings:write | Bookings, write | Create and cancel bookings |
availability:read | Availability, read | Read open slots |
resources:read | Resources, read | List your resources |
clients:read | Clients, read | List clients |
clients:write | Clients, write | Create clients |
wallet:read | Wallet, read | Read wallet transactions |
Each key can make up to 600 requests a minute. Above that the API answers with status 429.
Manage keys
The key table shows each key's name, first characters, scopes, Last used and status. Revoke switches a key off for good. To change scopes, create a new key and revoke the old one.
Add a webhook endpoint
- On Settings → Integrations, go to Webhooks and find New endpoint.
- Paste your URL. It must be a full address such as
https://your-n8n.example.com/webhook/nola. - Tick the Events you want to receive. Pick at least one.
- Click Add.
Nola sends these events today:
| Event | Sent when |
|---|---|
booking.created | A booking is made, online, by staff or through the API |
booking.updated | A booking's status changes, for example to confirmed or no-show |
booking.cancelled | A booking is cancelled |
payment.succeeded | An online payment goes through |
The list also offers extension.offered, extension.accepted and class.enrolled. You can subscribe to them, but Nola does not send them yet.
How deliveries work
Each event is a POST with a JSON body: event, createdAt and data. The headers include X-Nola-Event with the event name and X-Nola-Signature in the form t=<timestamp>,v1=<signature>. The signature is an HMAC-SHA256 of <timestamp>.<body> using the endpoint's secret. A verification snippet is in the REST API reference. The app does not show the secret yet, so contact support if you need it to verify signatures.
Your endpoint should answer with a 2xx status. Anything else counts as a failure:
- Nola retries with growing waits (up to an hour apart), up to 8 attempts per event.
- After 20 failed attempts in a row, the endpoint is switched off and shows Disabled with the failure count. Fix your server, then click Enable. A successful delivery resets the count.
Test and troubleshoot
Each endpoint row has these actions:
- Send test: shows "Test event sent", but the test event (
test.ping) does not reach endpoints at the moment. To test, make a booking on your own booking page and watch the Delivery log. - Enable or Disable: pause deliveries without losing the endpoint.
- Delivery log: every delivery with event, status, response code, attempts and time. Deliveries that used up all attempts have a Try again button.
- Remove: deletes the endpoint.
Legacy webhook URL
Below the endpoints is Legacy webhook URL, an older single-URL setting. It receives unsigned booking events separately from your endpoints. If you still use it, move to a signed endpoint and clear the field.
Related
Was this page helpful?
Still stuck?
Ask the AI Copilot inside Nola, or send a request to the Nola team. A person answers within one working day.