Build on magtyne cadence.

All requests go over HTTPS to the versioned base below. We never break a version in place; new fields are additive, and breaking changes ship under a new version prefix.

https://magtyne-cadence.vercel.app/api/v1

Send and expect application/json. All timestamps are ISO 8601 UTC; show them in the recipient's time zone in your UI.

Create a key under Integrations, Developer. It is shown once, so store it in a secret manager. Send it as a bearer token on every request; keys are scoped to a single workspace.

curl https://magtyne-cadence.vercel.app/api/v1/bookings \
  -H "Authorization: Bearer sk_live_your_key_here" \
  -H "Content-Type: application/json"

Rotate a key anytime; revoking it takes effect immediately. Never expose a key in client-side code.

The core resources. List endpoints are paginated with ?limit= (max 100) and a cursor returned as next_cursor.

curl -X POST https://magtyne-cadence.vercel.app/api/v1/bookings \
  -H "Authorization: Bearer sk_live_..." -H "Content-Type: application/json" \
  -d '{
    "eventType": "intro-call",
    "start": "2026-06-25T15:30:00Z",
    "invitee": { "name": "Wei Chen", "email": "wei@example.com" }
  }'

Errors return the right HTTP status and a JSON body with a stable code and a human message. Branch on code, not the message.

Add an endpoint under Integrations, Developer. We POST a signed JSON payload the moment something happens. Each delivery carries an X-Magtyne-Signature header; verify it with your endpoint secret before trusting the request.

Verify the signature (Node)

import crypto from 'node:crypto';

function verify(rawBody, header, secret) {
  const [t, sig] = header.split(',').map((p) => p.split('=')[1]);
  const expected = crypto.createHmac('sha256', secret)
    .update(`${t}.${rawBody}`).digest('hex');
  return crypto.timingSafeEqual(Buffer.from(expected), Buffer.from(sig));
}

Example payload

{
  "event": "booking.created",
  "createdAt": "2026-06-23T14:05:00.000Z",
  "data": {
    "id": "bk_8f2c...",
    "eventType": "intro-call",
    "start": "2026-06-25T15:30:00.000Z",
    "invitee": { "name": "Wei Chen", "email": "wei@example.com" }
  }
}

Send an Idempotency-Key header on POSTs so a retried request never double-books. We retry failed webhook deliveries with exponential backoff for 24 hours; make your handler idempotent by keying on the event id.

Limits apply per key and per IP, roughly 60 requests per 10 seconds on general endpoints with tighter windows on public booking and AI endpoints. A throttled request returns 429 with a Retry-After header; back off and retry.