Client authorization required

General
1

I’m integrating with your JSON-RPC API (company login: carinda) via a custom Zapier automation, and I’m stuck on a book() call that consistently fails with the error:

“Client authorization required”

This error is not listed in your public Errors Handling documentation, so I’m unable to determine what’s causing it from the docs alone.

Here’s what I’ve already confirmed working correctly with the same credentials, so you can rule these out:

  • getToken(company, apiKey) — succeeds, returns a valid token
  • getUserToken(company, adminLogin, adminPassword) — succeeds, returns a valid user token
  • getUnitList() — succeeds, correctly returns my provider/entertainer list
  • getAdditionalFields(eventId) — succeeds, correctly returns my configured intake form fields (IDs 5, 6, 8, 9, 14, 16)

I have tried the following variations on the book() call, and every single one returns the identical “Client authorization required” error with no change:

  1. Calling book() using only X-Company-Login + X-Token headers (from getToken)
  2. Calling book() with X-Company-Login + X-Token + X-User-Token headers added (from getUserToken)
  3. Calling book() with a fully populated additional parameter matching all fields returned by getAdditionalFields, including the required field (ID 14, “Name, email and Phone number of contact on the day of show”), formatted as an array of {name, value, type} objects

Since the error persists identically across all three attempts, I suspect either:

  • An account-level setting is blocking or restricting API-created bookings, or
  • There’s a required parameter, flag, or header on the book() method that isn’t covered in the public API documentation

Could someone check your server-side logs for these failed book() calls against my account and let me know exactly what’s triggering this error and how to resolve it?

Endpoint used: https://user-api.simplybook.me/
Method: book (JSON-RPC 2.0)
Company: carinda

Here’s the exact JSON-RPC request body my code constructs and sends for the book() call

json

{
  "jsonrpc": "2.0",
  "method": "book",
  "params": [
    6,
    "<unitId — the matched provider's SimplyBookMe unit ID, resolved dynamically from getUnitList>",
    "2026-10-16",
    "07:30",
    {
      "name": "STEVE",
      "email": "",
      "phone": ""
    },
    [
      { "name": "9fde671a151ef4a667665c48d9d9f7c7", "value": "STEVE", "type": "textarea" },
      { "name": "4658c825db37dad5b740456f52e00600", "value": "Music", "type": "textarea" },
      { "name": "53f4b545940e84776ac19607f571fb5f", "value": "STEVE", "type": "textarea" },
      { "name": "02e7fbb896864a2658c896a4628eccb8", "value": "Steve - Glenhaven", "type": "textarea" },
      { "name": "de2f0957cd24a48d48b4196d9dbfb6dc", "value": "STEVE /  / ", "type": "textarea" },
      { "name": "632487ad04283c26a0e949e638f3eae9", "value": "", "type": "textarea" }
    ],
    1,
    null,
    null
  ],
  "id": 1
}

Sent to: POST https://user-api.simplybook.me/

Headers:

Content-Type: application/json
X-Company-Login: carinda
X-Token: <valid token obtained from getToken, confirmed working>

Response received:

json

{
  "jsonrpc": "2.0",
  "error": {
    "message": "Client authorization required"
  },
  "id": 1
}

What is the solution ?

Thank you,

3

Hi Steven,

Thank you for the detailed report. It made the issue easy to pinpoint.

Cause

The “Client authorization required” error means the Client Login feature is enabled for your company. With this feature on, the public book() method (on https://user-api.simplybook.me/) only accepts an authenticated client. Plain name/email/phone data isn’t enough, and adding X-User-Token has no effect on the public endpoint. That’s why all three of your attempts returned the same error.

Recommended solution for a server-side integration (Zapier)

Use the Admin API instead of the public one. You already have a working user token from getUserToken().

Steps:

  1. Find the client with getClientList(searchString), or create one with addClient({name, email, phone}). This returns the client id.

  2. Call book with this signature:

    book(eventId, unitId, clientId, startDate, startTime, endDate, endTime, clientTimeOffset, additional, count)

    For example:

    {
    “jsonrpc”: “2.0”,
    “method”: “book”,
    “params”: [6, unitId, clientId, “2026-10-16”, “07:30:00”, null, null, 0, { …additional fields… }, 1],
    “id”: 1
    }

The admin API doesn’t require client authorization. The admin user whose credentials you use needs permission to manage bookings.

Alternative: keep using the public API

Pass the client’s client_id and client_sign inside clientData, where client_sign = md5(client_id + client_hash + secret_key). New clients can be registered with signUpClient() if client registration is allowed in your Client Login settings.

Disabling the Client Login feature would also remove this check, but it affects your booking website too. Only do it if you don’t need client accounts.

Additional fields format

The additional parameter must be an object keyed by the field name, not an array of {name, value, type} objects:

{
“9fde671a151ef4a667665c48d9d9f7c7”: “STEVEN H”,
“4658c825db37dad5b740456f52e00600”: “Music”,
“53f4b545940e84776ac19607f571fb5f”: “STEVEN H”,
“02e7fbb896864a2658c896a4628eccb8”: “Steven H - Glenhaven”,
“de2f0957cd24a48d48b4196d9dbfb6dc”: “STEVEN HEARN / … / …”,
“632487ad04283c26a0e949e638f3eae9”: “”
}

With the array format, required fields such as ID 14 would fail validation even after the authorization issue is solved. Please also pass the time as HH:MM:SS (e.g. 07:30:00).

One more tip: this is a public forum, so you may want to edit your post to remove the real email address and phone number.

Best regards,
Vitalii
SimplyBook.me Team

4

Thank You Vitallii