HairDora for developers

Read and write your salon data from your own code: a REST API with scoped keys and per-key rate limits over appointments, clients, services and salons, and signed webhooks when something changes.

API keys

Get a key and authenticate

The HairDora REST API lets your own backend work with the same records the dashboard shows: the appointments in your calendar, the clients who book them, the services you offer and the salons they belong to.

An administrator of your organization creates an API key in the HairDora dashboard. The secret is shown once, when the key is created, and never again — store it somewhere safe. A key belongs to a single organization, so the organization is implied by the key and never has to be sent; a key can additionally be locked to one salon.

Authenticate every request with HTTP Basic auth carrying only the key secret, base64-encoded, in the Authorization header.

# The Authorization header is HTTP Basic auth carrying only the key secret,
# with no username and no colon.
Authorization: Basic $(printf %s YOUR_API_KEY_SECRET | base64)

Every endpoint lives under https://api.hairdora.com. Requests made with a key are rate limited per key; going over the limit returns 429.

Quick start

Your first three calls

Find your salon, read the week ahead in its calendar, then add a client to it.

# List the salons the key can reach
curl https://api.hairdora.com/api/salons \
  -H "Authorization: Basic $(printf %s YOUR_API_KEY_SECRET | base64)"

# List next week's appointments for one salon.
# startTime and endTime are ISO 8601 instants.
curl -G https://api.hairdora.com/api/appointments \
  --data-urlencode "salonId=SALON_ID" \
  --data-urlencode "startTime=2026-01-06T00:00:00.000Z" \
  --data-urlencode "endTime=2026-01-13T00:00:00.000Z" \
  --data-urlencode "sortField=startTime" \
  --data-urlencode "sortDirection=ASC" \
  -H "Authorization: Basic $(printf %s YOUR_API_KEY_SECRET | base64)"

# Create a client in that salon
curl -X POST https://api.hairdora.com/api/clients \
  -H "Authorization: Basic $(printf %s YOUR_API_KEY_SECRET | base64)" \
  -H "Content-Type: application/json" \
  -d '{
    "salonId": "SALON_ID",
    "firstName": "Ada",
    "lastName": "Lovelace",
    "email": "ada@example.com"
  }'

Browse the full API reference — every endpoint with its parameters, request body, responses and required scope.

Claude connector

Use HairDora from Claude

Connect HairDora to Claude to ask about the salons, clients, appointments and services in your organization. The connector uses your HairDora account and the HairDora API applies the same organization boundary as the dashboard.

In Claude, open Settings, choose Connectors, then add a custom connector with the URL below. Claude sends you to HairDora to sign in and approve read access.

# In Claude: Settings > Connectors > Add custom connector
# Connector URL
https://mcp.hairdora.com/mcp

# Then sign in to your HairDora account when Claude asks you to connect.
# Example prompt: "Show an overview of my salon and its upcoming appointments."

The connector is read-only. It can render compact salon-overview and appointment-detail cards, while the text results remain available to any compatible MCP client, including ChatGPT.

Appointment notes and client contact details can contain personal information. Only connect accounts and conversations that are authorized to handle your salon data, and disconnect the connector when that access is no longer needed.

Scopes

Least privilege by default

Each key carries a list of scopes, so an integration that only needs to read your calendar never gets the ability to change it. New keys start read-only; widen them explicitly in the dashboard. A request whose key is missing the scope an endpoint requires is refused with 403.

  • appointments:readList appointments and read a single appointment.
  • appointments:writeCreate, update and delete appointments.
  • clients:readList clients and read a single client.
  • clients:writeCreate, update and delete clients.
  • services:readList services and read a single service.
  • services:writeCreate, update and delete services.
  • salons:readList the salons of your organization and read one.

There is no salons:write scope: a salon is the container your data lives in, created when you sign up, not something an integration creates.

Webhooks

Signed webhooks

Add a webhook subscription to your salon and HairDora POSTs the events you picked to your server as they happen. An empty event list subscribes to all of them.

  • appointment.createdAn appointment was booked.
  • appointment.updatedAn appointment was moved, rescheduled or edited.
  • appointment.deletedAn appointment was deleted.
  • client.createdA client was added.
  • client.updatedA client's details changed.
  • service.createdA service was added.
  • service.updatedA service was edited.
POST https://your-server.com/hairdora-webhook
X-Hairdora-Event: appointment.created
X-Hairdora-Signature: t=1719000000,v1=<hmac-sha256 hex>
Content-Type: application/json

{
  "event": "appointment.created",
  "timestamp": 1719000000,
  "data": { "...": "..." }
}

Verify the signature

Every delivery carries an X-Hairdora-Signature header of the form t=timestamp,v1=signature, where the signature is an HMAC-SHA256 of timestamp.body keyed by the subscription secret shown to you once when the subscription was created. Recompute it over the raw body and compare before trusting the payload.

import crypto from 'node:crypto'

// body must be the RAW request body, byte for byte
function verify(header, body, secret) {
  const [t, v1] = (header || '').split(',').map(part => part.split('=')[1])
  if (!t || !v1) return false

  const expected = crypto
    .createHmac('sha256', secret)
    .update(`${t}.${body}`)
    .digest('hex')

  // timingSafeEqual throws on a length mismatch, so a malformed signature
  // has to be rejected before the comparison rather than by it.
  if (v1.length !== expected.length) return false

  return crypto.timingSafeEqual(Buffer.from(v1), Buffer.from(expected))
}

Delivery is one best-effort attempt with a five second timeout and no retries, so respond 2xx quickly and do the work asynchronously. An endpoint that fails twenty times in a row is disabled automatically and has to be re-enabled in the dashboard.

Start building