TokenNo

Integration API

Plug TokenNo into the systems you already run.

Hospitals, clinics and restaurants can connect their HMS, clinic software or POS to TokenNo — both ways. Your system stays the source of truth for what it does best, and TokenNo runs the live queue.

Request API access

Works in both directions

  • Pull from TokenNo

    Read your locations, service points, sessions, tokens and the live queue from your own software.

  • Push actions in

    Create walk-in and phone tokens, call, serve, push back or cancel tokens, and manage slots and holidays — the same things you can do in the app.

  • Get events out

    Receive signed webhooks the moment something happens: a token is created, called, renumbered, served or cancelled, a session is cancelled, a payment succeeds and more.

A quick look

A few of the endpoints and events. Full documentation is shared when you get API access.

What teams connect

  • Hospital management systems (HMS)
  • Clinic and practice software
  • Restaurant POS and table management
  • Your own website or internal tools
TokenNo Integration API

Authentication

  • Authorization: Bearer tkn_live_…
  • # test mode: tkn_test_…

Endpoints

  • GET /v1/integration/sessions/:sid/queue
  • GET /v1/integration/tokens?date&servicePointId&status
  • POST /v1/integration/sessions/:sid/tokens
  • POST /v1/integration/tokens/:tid/call
  • POST /v1/integration/tokens/:tid/push-back

Webhook events

  • token.created
  • token.called
  • token.renumbered
  • token.cancelled
  • token.served
  • session.cancelled
  • holiday.created
  • payment.succeeded
  • X-TokenNo-Signature: v1=<HMAC-SHA256>

Security built in from day one

API keys are issued by TokenNo and created by the business owner or manager in TokenNo Business. Every call is audit-logged.

  • Keys shown once

    A new secret key is shown a single time. TokenNo stores only a hash of it, never the key itself.

  • Scopes and locations

    Give each key only what it needs — read the queue, write to the queue, manage schedules — and limit it to specific locations.

  • IP allowlist

    Optionally accept calls only from your own servers' IP addresses.

  • Rotate, expire, revoke

    Set an expiry date, rotate keys with an overlap window so nothing breaks, and revoke a key instantly.

  • Signed webhooks

    Every webhook is signed with HMAC-SHA256 and a timestamp, so you can verify it came from TokenNo and block replays. Failed deliveries are retried and can be replayed.

  • Test mode

    Build against test keys and sandbox data first, then switch to live keys when you're ready.

  • Safe retries

    Write calls accept an Idempotency-Key, so a retry never creates a duplicate token. Rate limits apply per key.

  • Minimal patient data

    The API follows the same data rules as the apps: in the first phase, only a name and mobile number per customer.

Want to connect your system?

Tell us what you use today and we'll set you up with test keys and the full API docs.

Request API access