API terms

Effective 4 September 2026 · Applies to the developer API, the MCP server and the embed widget

These terms sit on top of the business terms you already agreed to. They are written to be read. Where they and the business terms differ about the API, these win.

1. Who this is between

MyBookr LTD (“Bookr”, “we”), registered in England & Wales, and the business that holds the Bookr account whose key is being used (“you”). If a developer, agency or AI assistant uses a key on your behalf, you are responsible for what they do with it.

2. What you get

• The embed widget — your live booking page inside a website you have registered.
• The REST API at mybookr.app/api/v1 — read and, with the right scopes, manage your own business's data.
• The MCP server at mybookr.app/mcp — the same operations, for AI assistants that speak the Model Context Protocol.

All three are part of the Pro plan. A key for a business on a lower plan is refused until the plan changes. Everything is documented at mybookr.app/developers; the documented behaviour is what we commit to.

3. Your key

• A key is a credential. Treat it like a password. Bookr stores only a fingerprint of it and cannot show it to you again.
• Only a read-only key without customer, message or money scopes (read:catalog, read:bookings, read:reviews) may be placed on a public website. A key with read:customers, write:customers or any other write scope must be kept server-side or in a tool you control.
• You can revoke a key at any time in the app or at Developer settings. Revocation is immediate and cannot be undone.
• If you believe a key has leaked, revoke it. We will help you understand what it was used for from the activity log.

4. Customer data

Customer details your key reads through read:customers — names, emails, phones, your notes — are personal data of which you are the controller under UK GDPR, and Bookr is your processor, exactly as in the app. You must have a lawful basis for what you do with them, keep them safe wherever your systems put them, honour customers' rights, and not use them for marketing they have not consented to. Do not pass them to a third party (including an AI service) unless you are satisfied that doing so is lawful and your customers would expect it.

5. Acceptable use

• Use the API only for the business the key belongs to. There is no cross-business access; do not try to find any.
• Do not attempt to take or store card details through the API. Customer payment always happens inside Bookr's own page or frame.
• Do not create bookings, walk-ins or blocks that do not reflect real intent, scrape other businesses' pages, or use the API to send unsolicited messages.
• Respect the rate limits (published on the developer page). We may lower them for a key that harms the service, and may revoke a key that breaks these terms.
• The acceptable use policy applies to anything created through the API just as it does in the app.

6. Availability and changes

We run the API on the same infrastructure as Bookr itself and aim for it to be available whenever Bookr is; we do not promise a specific uptime. We may add endpoints and fields at any time. We will not remove or rename an endpoint, or narrow what a scope allows, without at least 30 days' notice on the developer page — except where security requires it, in which case we will tell you afterwards.

7. What we are not responsible for

We are not responsible for what your own website, tools or an AI assistant do with the data or the operations the API gives them, for bookings they create or cancel on your instruction, or for a key you did not protect. Our liability to you for the API, the MCP server and the embed is limited in the same way as under the business terms.

8. Ending

You can stop using the API at any time by revoking your keys. Closing your Bookr account revokes every key. We can suspend a key immediately where we reasonably believe it is being misused, and will tell you why.

9. Questions

Email support@mybookr.app. For anything about how we handle data, see the privacy policy.