Skip to main content
Send an API key with the HTTP Bearer authentication scheme:
Your studio gets two keys, and which one an endpoint accepts is part of its contract. Sending the wrong key fails — the two are never interchangeable.

​
Public API key

Prefix zen_pub_. It reads the data your studio already publishes: the schedule, workshops, lecturers, and locations.
  • Safe to ship in client-side code
  • CORS is open, so you can call it from any origin
  • Exposes no personal data

​
Secret API key

Prefix zen_live_. It reads and writes client data.
  • Backend only. Never call it from a browser or a mobile app
  • Exposes personal data, including names, emails, and balances
  • Can grant credits and entry passes, which changes what clients owe and hold
Never put the secret key in front-end code, a mobile app bundle, or a public repository. Anyone holding it can read your entire client list.

​
Getting your keys

In the Zenamu admin, open Settings → General info → API keys, then select Generate API keys. The secret key is displayed once, at generation time. Zenamu stores only a hash of it, so it cannot be shown again — if you lose it, regenerate the pair.
Self-service generation requires the Ultimate plan. Studios on a trial get their keys from Zenamu support. See Plans and access.

​
Rotating keys

Regenerating replaces both keys at once and the previous pair stops working immediately. Every integration using the old keys breaks until you swap in the new ones, so plan the rotation rather than doing it live.

​
Authentication errors

The 400 and 401 messages retain legacy wording. Your credential is still an API key.
An unknown key answers 404, not 401. This is unusual, and a client that only branches on 401 will misread a bad key as a missing resource. Treat 404 on a list endpoint as an authentication failure.
Authentication runs before parameter validation. A request that both omits its key and passes a bad dateFrom returns the authentication error.

​
CORS

The four public endpoints answer cross-origin requests from any origin, so a browser can call them directly with the public key. The private endpoints — /v1/clients, /v1/pass-groups, and the credit and pass endpoints — are backend-only. All of them block CORS outright, so there is no origin a browser can call them from. Do not plan on browser access to any of them: the secret key must never reach a browser in the first place.