Base URL #
All endpoints live under https://mixcalendar.mixcommerce.co/api/v1/. Requests and responses are JSON, and every request must use HTTPS.
Creating an API Key #
Open Settings → API keys and generate a key. The full value is shown once at creation and stored only as a hash afterwards, so record it immediately. Keys carry the permissions of the user who created them and can be scoped to read-only.
Sending the Key #
curl https://mixcalendar.mixcommerce.co/api/v1/event-types
-H "Authorization: Bearer mc_live_xxxxxxxxxxxxxxxx"
-H "Accept: application/json"Keys belong on a server. A key embedded in browser code is readable by anyone who opens the page and should be considered compromised the moment it ships.
OAuth for Third-Party Applications #
If you are building an application that acts on behalf of other MixCalendar users, register an OAuth client instead of distributing keys. The authorisation code flow with PKCE is supported, and access tokens are short-lived with refresh tokens issued alongside.
Rate Limits #
Requests are limited per key. Each response carries X-RateLimit-Limit, X-RateLimit-Remaining, and X-RateLimit-Reset. Exceeding the limit returns 429 with a Retry-After header; retry with exponential backoff rather than a tight loop.
Errors #
Errors return a JSON body with a machine-readable code, a human-readable message, and where relevant a field. Treat 4xx as a problem with the request and 5xx as safe to retry.
Rotating Keys #
Create the replacement first, deploy it, then revoke the old key. Revocation is immediate and cannot be undone.
