Connect your salon's own tools: the Slotora API and webhooks

What salons connect

Zapier

„Webhooks by Zapier” catches every new booking and sends it on — to Google Sheets, Mailchimp, Slack, your CRM.

Make

A „Custom webhook” scenario, or the HTTP module reading your bookings and clients on a schedule.

Your bookkeeper

A key that reads bookings and payments, and nothing else — no client contact details if you hide them.

Your own website

Free times from the API, and a booking made the same way the front desk makes one.

Keys: one per tool, and only what it needs

Only the salon's owner or an admin can create a key. It is shown once — copy it straight into the tool — and Slotora keeps only a fingerprint of it, so nobody can read it back, us included. Give every tool its own key: revoking one stops that tool and nothing else. A key also stops by itself when the person who created it no longer manages the salon.

The API

Everything is JSON over HTTPS at https://slotora.io/api/v1. Send the key in the Authorization header as „Bearer slt_live_…” (or as X-Api-Key). Dates come back in the salon's own time zone with the offset — 2026-10-13T14:00:00+01:00 — so a spreadsheet shows the time your diary shows. A plain date in a filter (2026-10-13) means that day in the salon's zone. The machine-readable description is at /api/v1/openapi.json.

curl https://slotora.io/api/v1/bookings?from=2026-10-13&to=2026-10-19 \
  -H "Authorization: Bearer slt_live_YOUR_KEY"

Pages, errors and limits

• Lists come a page at a time: data, and nextCursor. Pass nextCursor back as cursor until it is null. limit is 1–100 (50 by default).
• Every error is { "error": { "code": "…", "message": "…" } }: unauthorized (401), insufficient_scope (403), not_found (404), invalid_request (400), slot_taken (409), rate_limited (429).
• A key may make 120 requests a minute. Past that the answer is 429 with Retry-After.
• A booking is made by the same code as one at your front desk: the time must be one the salon offers, rooms and chairs are checked, and the guest gets your usual confirmation. Send an Idempotency-Key header and a retry within five minutes returns the booking the first request made instead of a second one.
• Another salon's ids answer not_found, exactly like ids that do not exist. Every request a key makes is in the salon's request log for 30 days.

Webhooks

Add the address your tool gave you in Settings → API & webhooks and tick what to send. Slotora looks for changes every quarter of an hour, so an event arrives within about 15 minutes of happening. Each address must be https, on the public internet; redirects are not followed.

{
  "id": "evt_…",                  // the same on every retry: ignore one you have seen
  "type": "booking.created",
  "occurredAt": "2026-10-13T09:41:07+01:00",
  "salon": { "id": "…", "timezone": "Europe/London" },
  "data": { …the booking, client or payment, as the API returns it… }
}

Checking that a webhook came from Slotora

Every delivery carries Slotora-Signature: t=<unix time>,v1=<signature>. The signature is an HMAC-SHA256, in hex, of the time, a full stop and the exact body, made with the endpoint's signing secret (whsec_…, shown once when you add it). Recompute it, compare, and refuse anything older than five minutes. Zapier and Make do not need this; your own server should.

import crypto from "node:crypto";

function fromSlotora(secret, header, rawBody) {
  const parts = Object.fromEntries(header.split(",").map((p) => p.split("=")));
  const expected = crypto.createHmac("sha256", secret)
    .update(`${parts.t}.${rawBody}`).digest("hex");
  const fresh = Math.abs(Date.now() / 1000 - Number(parts.t)) < 300;
  return fresh && expected.length === (parts.v1 ?? "").length &&
    crypto.timingSafeEqual(Buffer.from(expected), Buffer.from(parts.v1));
}

When your tool does not answer

• Any 2xx answer is success. Anything else, or no answer in 10 seconds, is retried after 1 minute, 5 minutes, 30 minutes, then 2, 6, 12 and 24 hours — eight tries in all. Each try is in the endpoint's delivery log.
• After 15 failed tries in a row, or three days of nothing but failures, the address is switched off and the owner gets a notification. Switch it back on from the same page once it is fixed.
• „Send a test” sends one signed delivery with sample data, so Zapier or Make can learn the fields without a real client's details.

Zapier, step by step

1. 1

   Catch the hook

   In Zapier, make a Zap whose trigger is „Webhooks by Zapier” → „Catch Hook”, and copy the address it shows.

2. 2

   Add it in Slotora

   Settings → API & webhooks → Webhooks: paste the address, tick what to send, press Add webhook.

3. 3

   Send a test

   Press „Send a test” beside it, then „Test trigger” in Zapier: the sample booking appears with all its fields.

4. 4

   Send it on

   Add the action — a Google Sheets row, a Mailchimp subscriber, a Slack message — and map the fields. To read from Slotora inside a Zap, use „Webhooks by Zapier” → „GET” with the header Authorization: Bearer and your key.

Make, step by step

1. 1

   A custom webhook

   In Make, start a scenario with Webhooks → „Custom webhook”, add one, and copy its address.

2. 2

   Add it in Slotora

   Paste it under Settings → API & webhooks → Webhooks, tick the events, and add it.

3. 3

   Learn the structure

   In Make press „Redetermine data structure”, then „Send a test” in Slotora: Make learns the fields from the sample.

4. 4

   Read on a schedule

   To pull bookings or clients instead, use HTTP → „Make a request” to https://slotora.io/api/v1/bookings with the header Authorization: Bearer and your key, and follow nextCursor.

The rest of this product

The other pages about Slotora for busy salons.

• The team's diary
• Rooms and chairs
• The front desk
• Renting a place
• What you owe each person
• Reports and the log
• Now and next
• Fresha compared
• Treatwell compared
• Timely compared
• More than one location
• No per-seat fee
• UK salon software compared
• Switching software
• Self-employed stylists
• Rota and holidays
• Colour records and patch tests
• Two stylists, one visit
• One bill at the counter
• Packages and courses
• Salon software in the UK