Getting started with the Rex API
The Rex API lets you build custom integrations, pull reservation data into your own systems, and automate venue management tasks.
Base URL
https://yourvenue.reservewithrex.com/api
Authentication
Rex does not accept a key directly on an API call. Your key is a Client ID and Client Secret pair, which you exchange for a short-lived access token, and that token goes in the Authorization header. Post the pair to the token endpoint:
POST /api/api-key/token { "clientId": "…", "clientSecret": "…" }
The response contains a token that is valid for one hour. Send it on each request:
Authorization: Bearer {token}
Request a fresh token when the old one expires. An integration that caches a token forever will start failing after an hour.
Key endpoints
GET /api/reservations — list reservations
GET /api/reservations/:id — get a single reservation
POST /api/reservations — create a reservation
PATCH /api/reservations/:id — update a reservation
GET /api/packages — list available packages
GET /api/availability — check availability for a date range
Generate and manage API keys
Your keys live on the API page in the admin dashboard. You can hold as many as you need, and each one is named, so give every integration its own rather than sharing a single key. That way you can rotate or remove one integration's access without breaking the others.
Open the API page
The page lists every key you hold, each in its own card titled with the key's name. View API Docs at the top opens the full endpoint reference.
Add a key
In the Add Key card, type a name in Key Name that says where the key will be used — "Zapier", "Website", "Production" — then click Generate.
Copy the Client Secret before you leave
The new key's card shows its Client ID and Client Secret with a copy button on each. The secret is shown this one time only, so copy it into your integration or password manager now. Click Done when you have it. After that the secret reads as dots and cannot be recovered — you would have to rotate the key to get a new one.
Rotate a key when you need a new secret
Rotate Key issues a fresh Client Secret for that key and reveals it once, exactly like creating one. The Client ID stays the same. Use this when a secret may have leaked or when someone who knew it leaves. The old secret stops working straight away, so update the integration in the same sitting.
Delete a key to cut off an integration
Delete Key removes it after a confirmation that names the key. Anything still using it loses access immediately, which is the point — deleting the key for one integration leaves your others untouched.
Only Global Admins can open the API page and read a key's values. The page is available on the Growth plan and above.
Treat the Client Secret like a password. Anyone holding the pair can act on your venue's data through the API, so never paste it into a shared doc, a ticket, or a chat message.
Updated Aug 17, 2026
Was this helpful?