Getting started

Authentication

One server credential defines the studio, environment, locations, and permissions for every request.

API keys

Send the key in the X-ClassFlow-Key header on every Partner API request.

HTTP

GET /partner/v1/classes HTTP/1.1
Host: api.getclassflow.com
X-ClassFlow-Key: cf_live_••••••••••••

Test and live environments

cf_test_…Test key

Read-only access to the studio’s current permitted data. Test keys are not a separate sandbox tenant and cannot receive write scopes.

cf_live_…Live key

Can receive read and write scopes. Webhook subscriptions require a live credential.

Scopes

Grant the minimum permissions needed by the integration. Missing permissions return 403 with the required scope.

studio:readread

Studio identity and locations

schedule:readread

Rooms, class types, instructors, classes, and availability

catalog:readread

Products and price records

forms:readread

Form definitions

form_submissions:readread

Submitted form answers and contact data

form_submissions:writewrite / manage

Submit answers to a published form

leads:readread

Lead contact and lifecycle data

leads:writewrite / manage

Create and update studio leads

members:readread

Member profiles and membership summaries

members:writewrite / manage

Create members; never changes billing or credits

bookings:readread

Bookings and waitlist state

bookings:writewrite / manage

Create through Booking Authority

bookings:cancelwrite / manage

Cancel through Booking Authority; studio policy can apply configured fees or forfeit credits

purchases:readread

Purchase ledger summaries without payment credentials

webhooks:managewrite / manage

Subscriptions, attempts, replay, and signing-secret rotation

Location restrictions

A key can be restricted to selected studio locations. Schedule, booking, purchase, room, and location reads enforce that list. An identifier outside the permitted locations returns 404, preventing resource-existence leaks.

Expiration, rotation, and revocation

Set an expiration date for temporary integrations and contractors.
Rotation creates a new one-time secret and revokes the replaced credential.
Webhook subscriptions transfer during credential rotation so delivery can continue.
Revoking or expiring a credential immediately stops API access and its webhook deliveries.