--- title: "How to Integrate the Mindbody API (2026)" canonical: "https://aifitnessapi.com/integrate/mindbody-api" cluster: "Integration Guides" primary_query: "how to integrate the Mindbody API" last_reviewed: "2026-10-17" description: "Integrate the Mindbody Public and Webhooks APIs: developer account, go-live approval, studio activation, the API-Key header, signed webhooks and limits." publisher: "AIFitnessAPI — independent, not sponsored" cite_as: "\"How to Integrate the Mindbody API (2026)\", AIFitnessAPI, https://aifitnessapi.com/integrate/mindbody-api" --- # How to Integrate the Mindbody API (2026) > Mindbody's developer program starts with a self-serve developer account, but going live is approval-gated: you request to go live, Mindbody approves you, and each business then activates your access with an activation link or code. Every request carries an API key in an API-Key header plus a User-Agent header, and Mindbody says requests must come from your back-end servers because keys cannot be stored safely on mobile devices or websites. For changes, the Webhooks API pushes events such as class bookings, new clients and sales, signed with HMAC-SHA-256 and resent every 15 minutes for up to 3 hours, and Mindbody recommends re-syncing cached data through the Public API every 24 hours. - Canonical: https://aifitnessapi.com/integrate/mindbody-api - Last reviewed: 2026-10-17 - Publisher: AIFitnessAPI (https://aifitnessapi.com) — independent, not sponsored - Cite as: "How to Integrate the Mindbody API (2026)", AIFitnessAPI, https://aifitnessapi.com/integrate/mindbody-api --- Mindbody gives developers two APIs: the **Public API**, which reads and writes a business's schedule, clients, sales and staff, and the **Webhooks API**, which pushes an event to your server when that data changes. This guide is written from Mindbody's own developer pages as they stood on October 17, 2026: the developer FAQ, the endpoints overview, the Webhooks documentation, the API Terms of Use, the Security Policy and the API release notes. > **Sourcing note.** Mindbody's Public API V6 reference is a JavaScript application, and it returned no readable text to our fetch. Endpoint paths, request fields and any OAuth flow documented only there are not covered on this page. Check them in the reference itself before you build. Still choosing a platform? Our [gym and studio management software API comparison](/fitness-apis/gym-management-software-apis) puts Mindbody next to TeamUp, Mariana Tek, Wodify and ABC Glofox. What the API costs is on [Mindbody API pricing](/pricing/mindbody-api-pricing). ## What the Mindbody API covers Mindbody's FAQ says the API "can be used to output live data from your Mindbody system to your main website", and lists what it does with site data: show the class or appointment schedule, add clients into services, access and manage client data, complete sales for services and retail products, and add and retrieve staff profiles and permissions. The endpoints overview groups the data like this: | Service | What Mindbody lists | |---|---| | Appointment | Book appointments, update appointments, view a staff member's appointment schedule | | Class | Class registration, update a client's visit, enrollment registration, view the class schedule | | Client | Add or update basic client information; contact logs, relationships and indexes; purchases and account; visit history | | Sale | Complete service and product purchases; view pricing options, products and packages; update products | | Site | Site and location information, service categories, resources, session types, activation codes, relationship types | | Staff | Add or update staff information, view staff permissions, retrieve staff photos | The same FAQ is candid about gaps. Asked whether the API can do everything, it answers "Not yet" and says the goal is to allow all Consumer and Business Mode functionality through the API. Card payments need the studio to hold an active Mindbody merchant account with one of the supported processors (TSYS, Bluefin, Elavon, Paysafe, Ezidebit and Adyen), which Mindbody says limits that access to the US, Canada (except Moneris clients), the UK, the EU, Australia, New Zealand and Hong Kong. ACH, Direct Debit and SEPA are not supported through the API. On versions, Mindbody's documentation says a developer account created on or after February 19, 2020 can only access V6.0 of the Public API, and that the V5.0 and V5.1 documentation needs a login. ## Access: sign up, go live, then activate each business Mindbody's Webhooks getting-started steps spell out the access path: 1. Create a developer account on Mindbody's developer portal. 2. While logged in, request to go live with that account. 3. Once Mindbody approves you for live access, activate the link between your developer account and at least one Mindbody business. The FAQ describes the business side of step 3: once the developer has joined the program and the business has given access to its site data "using an activation link or code", the integration can begin. The endpoints overview lists generating activation codes under the Site service. In our reading, that makes every studio an explicit opt-in. Mindbody's approval gets you live, but a business's data flows only after that business activates you. Mindbody's API Terms of Use point the same way: among the prohibited uses are accessing Mindbody Data without the authorization of the Subscriber, and requiring end users to give their login credentials to a third-party developer. ## Authentication: an API key, from your server only - **Header.** Pass an API key in an `API-Key` header. A call without one gets HTTP 401 and the error type `missingAPIKeyHeader`. - **One set of keys.** Keys live on the API Credentials page of your developer account, and the Webhooks API accepts the same keys as the Public API. - **Server-side only.** Mindbody says that because API keys cannot be safely stored on mobile devices or websites, all requests to the API must come from your back-end servers. - **User-Agent.** Mindbody requires a `User-Agent` header on calls to its APIs. Mindbody's Security Policy adds handling rules: store credentials securely at rest and in transit, share them with your team only on a need-to-know basis, never keep them in source control, and never let them be logged, even in development tools. It warns that a violation could cost you access to the Mindbody API permanently. Mindbody's release notes also mention requests made with an OAuth consumer identity token and with business mode authentication. How to obtain those tokens is documented in the V6 reference we could not read. ## Webhooks: subscriptions, signatures and retries The Webhooks API lives at `https://mb-api.mindbodyonline.com/push/api/v1`, accepts and returns JSON, and must be called over HTTPS with TLS 1.2 or higher. You create a subscription for one or more events with a POST, activate it with a PATCH, and deactivate it with a DELETE. Your webhook URL has to: - accept HTTPS connections using TLS 1.2 or higher; - accept both POST requests, which deliver events, and HEAD requests, which Mindbody uses to check the URL when you create a subscription; - answer with a 2xx within 10 seconds. Otherwise Mindbody resends the event every 15 minutes and gives up after 3 hours. Mindbody does not guarantee that an event arrives only once or in chronological order, so it recommends idempotent processing, and it suggests putting incoming events on a queue so you can respond quickly. If Mindbody stops getting 2xx responses, it may deactivate the subscription and email the developer portal account that created it. Events that happen while a subscription is inactive are not stored or delivered later. ### Verify the signature Each delivery carries an `X-Mindbody-Signature` header. Mindbody's instructions: compute an HMAC-SHA-256 of the request body, keyed with the `messageSignatureKey` returned when you created the subscription, prepend `sha256=`, and compare the result with the header. Mindbody's C# sample Base64-encodes the hash before prepending the prefix. The same check in Node.js: ```js import crypto from "node:crypto"; // rawBody: the exact bytes Mindbody posted. // key: the messageSignatureKey returned when the subscription was created. export function isMindbodySignatureValid(rawBody, header, key) { const expected = "sha256=" + crypto.createHmac("sha256", key).update(rawBody, "utf8").digest("base64"); const a = Buffer.from(expected); const b = Buffer.from(header ?? ""); return a.length === b.length && crypto.timingSafeEqual(a, b); } ``` ### What you can subscribe to Mindbody's event reference covers sites and business-day closures, locations, appointments and appointment add-ons, class schedules, single classes, class bookings and their status, class waitlists, class descriptions, clients (including profile merges), memberships, contracts, sales and staff. For example, `classRosterBooking.created` fires when a client is booked into a class, `client.created` when a new client is added to a business, and `clientSale.created` when a sale is made to a client. The June 2026 release notes added three Pick a Spot events: `pickASpotReservation.created`, `pickASpotReservation.updated` and `pickASpotReservation.deleted`. An event carries only some fields, so Mindbody tells you to call the Public API for the rest and to re-sync your cached data through the Public API every 24 hours. To match events with your own writes, send the optional `Transaction-Key` header (up to 50 characters) on Public API calls. Events those calls trigger carry it back as `transactionKey`, provided the source name making the call is the one that created the webhook subscription. ## Limits The Webhooks documentation describes two kinds of rate limits: daily call limits, which are defined when you receive your API key, and system limits. To raise yours, you contact your account manager. The API Terms of Use say Mindbody sets call limits based on how your applications may be used and their anticipated volume, may charge for calls over the limit or terminate access, and never rolls unused calls over to the next day or month. Mindbody's FAQ puts a number on the daily allowance and the charge beyond it, which we cover on [Mindbody API pricing](/pricing/mindbody-api-pricing). ## Terms that shape your architecture Three clauses in Mindbody's API Terms of Use, last updated September 30, 2023, affect design, not just legal review: - **Caching.** The prohibited uses include caching Mindbody Data in excess of 48 hours. Together with the Webhooks advice to re-sync every 24 hours, in our reading the intended pattern is a short-lived cache refreshed from Mindbody, not a long-term copy. Read the full clause with counsel before you design storage. - **Competition.** You may not use the API in a product or service that competes with Mindbody's own products or services. - **Termination.** Mindbody may suspend or terminate API access at any time. You can end the agreement with 90 days' written notice. This is general information, not legal advice. ## What changed in 2026 From Mindbody's API release notes: - **July 2026.** Cancelling a class now requires credentials with both the Manage Class Schedules and Cancel Reservations permissions, in V5 and V6. Without the second permission the request returns a permission error and cancels nothing. - **June 2026.** Apple Pay became available to every Public API customer through the existing alternative-payments checkout flow (payment method ID 801), and Pick a Spot reservations gained webhook events. - **May 2026.** `AddAppointment` accepts multiple appointments in one request that either creates all of them or none, and `AddMultipleAppointments` was deprecated. For the general patterns behind this page, see [what webhooks are](/learn/what-are-webhooks) and [ingesting webhooks reliably](/architecture/webhook-ingestion). The rest of the cluster is at [how to integrate a fitness or health API](/integrate). ## Sources - [developers.mindbodyonline.com/WebhooksDocumentation](https://developers.mindbodyonline.com/WebhooksDocumentation) — Getting started (developer account, go-live request, business activation), API-Key and User-Agent headers, server-side requests, signature verification, webhook URL requirements, retries, rate limit kinds, re-sync advice, Transaction-Key, base URL and the event reference. (checked 2026-10-17) - [developers.mindbodyonline.com/resources/faqs](https://developers.mindbodyonline.com/resources/faqs) — What the API does, activation link or code, card-processing requirements, and what the API cannot do yet. (checked 2026-10-17) - [developers.mindbodyonline.com/Resources/Endpoints](https://developers.mindbodyonline.com/Resources/Endpoints) — Appointment, Class, Client, Sale, Site and Staff data elements. (checked 2026-10-17) - [developers.mindbodyonline.com/PublicDocumentation/GettingStarted](https://developers.mindbodyonline.com/PublicDocumentation/GettingStarted) — Accounts created on or after February 19, 2020 can only access V6.0 of the Public API. (checked 2026-10-17) - [developers.mindbodyonline.com/Resources/DeveloperAgreement](https://developers.mindbodyonline.com/Resources/DeveloperAgreement) — API Terms of Use (last updated September 30, 2023): call limits, prohibited uses including the 48-hour caching limit, termination. (checked 2026-10-17) - [www.mindbodyonline.com/company/legal/security-policy](https://www.mindbodyonline.com/company/legal/security-policy) — API credential handling rules. (checked 2026-10-17) - [developers.mindbodyonline.com/Resources/ApiReleaseNotes](https://developers.mindbodyonline.com/Resources/ApiReleaseNotes) — May to July 2026 changes: AddAppointment, Apple Pay, Pick a Spot events, class cancellation permissions; OAuth consumer identity token and business mode references. (checked 2026-10-17) ## FAQ ### Does the Mindbody API need approval before an integration goes live? Yes. Mindbody's getting-started steps are to create a developer account, request to go live while logged in, and, once Mindbody approves you for live access, activate the link between your developer account and at least one Mindbody business. Mindbody's FAQ says a business gives a developer access to its site data with an activation link or code, so each studio opts in separately after Mindbody's approval. [Permalink](https://aifitnessapi.com/integrate/mindbody-api#faq-1) ### How are Mindbody API requests authenticated? With an API key sent in an API-Key header, created on the API Credentials page of your Mindbody developer account. The same keys work for the Public API and the Webhooks API, a call without the header returns HTTP 401, and Mindbody requires a User-Agent header too. Mindbody says all requests must come from your back-end servers, because API keys cannot be safely stored on mobile devices or websites. [Permalink](https://aifitnessapi.com/integrate/mindbody-api#faq-2) ### How do I verify that a webhook really came from Mindbody? Check the X-Mindbody-Signature header. Mindbody's instructions are to compute an HMAC-SHA-256 of the request body using the messageSignatureKey returned when you created the subscription, prepend sha256= to the encoded result, and compare it with the header; Mindbody's C# sample Base64-encodes the hash. If the strings match, Mindbody says the message came from its servers. [Permalink](https://aifitnessapi.com/integrate/mindbody-api#faq-3) ### What happens when my Mindbody webhook endpoint is down? Mindbody resends an event every 15 minutes when it gets no 2xx response within 10 seconds, and stops after 3 hours. If it keeps failing, Mindbody may deactivate the subscription and email the developer portal account that created it, and events that occur while the subscription is inactive are not stored for later delivery. Reactivate the subscription with a PATCH once the endpoint is fixed, and run a manual sync through the Public API. [Permalink](https://aifitnessapi.com/integrate/mindbody-api#faq-4) ### Can I keep a copy of Mindbody data in my own database? Only with care. Mindbody's API Terms of Use list caching Mindbody Data in excess of 48 hours among the prohibited uses, and its Webhooks documentation recommends re-syncing cached data through the Public API every 24 hours. In our reading that points to a short-lived cache refreshed from Mindbody rather than a permanent copy. Read the full clause with counsel; this is not legal advice. [Permalink](https://aifitnessapi.com/integrate/mindbody-api#faq-5)