AI agents and your booking data: what a key lets in, and what it never touches
Bookatu has two doors for AI: the assistant inside your admin and outside agents that connect with an API key. What each one can do, how keys and scoping work, and the lines nothing is allowed to cross.
Letting AI anywhere near your client list deserves a clear-eyed look. Your booking data is your business: who your clients are and when they come in. So before you connect anything, it is worth understanding exactly how Bookatu lets software in, and where the walls are. There are two doors, and they are deliberately different.
Inside: the assistant behind your login
The first door is the assistant built into the Bookatu admin. It lives behind your login, works in plain words, and follows one rule everywhere: it proposes, you confirm. Ask it to book a client or move an appointment and it shows you exactly what it is about to do before anything happens. Confirm and it goes through, and nearly every change can be undone in a tap afterwards. It is for you and your team, not the public, and it is the right tool for running your day, the small changes that pile up across a shift.
Outside: the key is the contract
The second door is for software that lives outside the admin: a tool you already use, a custom integration, an MCP assistant like Claude Desktop. All of it comes in through the API, and the unit of trust there is the API key. A few properties do most of the work:
- You issue it. Keys are created in your admin, by you, and shown exactly once. Bookatu stores only a fingerprint, never the key itself.
- It has a strength. A read-only key can look but not touch. Creating a booking takes a read-write key. Give each connection the least it needs.
- It leaves a trail. Bookatu records when each key was last used, so you can see what is actually connecting.
- It dies on command. Revoke a key and it stops authenticating immediately. You can also set an expiry when you create it.
Scoped to your business, always
Every key belongs to exactly one business. Whatever an agent asks for, the request is resolved against your business and nothing else. A key issued for one business can never read another's data, and there is no request an outside agent can make that crosses that line. Even the webhook notifications Bookatu can send to your other tools are deliberately lean: they carry no client contact details, and software that wants the full record has to come back through the API with your key.
What a key-holding agent can and cannot do
With a read-only key, an agent can read your services and prices, your live availability, your client list and your upcoming appointments. That is enough for a reporting dashboard or an assistant that answers what does my week look like.
With a read-write key, it can also act: create a booking, or cancel one through the API. Bookings it creates follow the same rules as your booking page: real availability, your minimum notice and your deposit policy. A deposit-taking service booked by an agent comes back pending with a payment link for the client, not confirmed for free.
And here is the list that matters most, the things no key unlocks because they do not exist as agent-facing capabilities at all: deleting your clients or your history, changing your plan or billing, managing logins or staff permissions, and reaching any other business on the platform. There is no super-key to leak. Those capabilities simply are not on the menu.
Give a reporting tool a read-only key and it can look all day without being able to change a thing.
Which door for which job
Use the inside assistant when you are the one driving: moving a three o'clock while your hands are full, or blocking out Friday afternoon. It proposes, you confirm, you can undo. Use a key when software is driving: your own dashboard pulling appointments, or an MCP assistant on your laptop booking clients in. Start every new connection with a read-only key, and upgrade it to read-write only when the tool genuinely needs to book.
The point of all this is not paranoia. It is that saying yes to useful AI is much easier when the worst case is small and the exits are clearly marked. Connect an agent, watch what it does, and if you ever stop trusting it, revoke the key and it is gone. The full technical detail, endpoints, key scopes and examples, is on the Bookatu developers page, and keys are issued from your admin dashboard. Your data stays yours. An agent just gets a key, and only to the rooms you chose.
