# Client authorization required

**URL:** https://tech-support.simplybook.me/t/client-authorization-required/2384
**Category:** General
**Created:** [September 29, 2026, 3:24am UTC](https://tech-support.simplybook.me/t/client-authorization-required/2384 "2026-09-29T03:24:04Z")
**Posts on this page:** 4
**Page:** 1

<div class="post-metadata">

### Author: ![SJH-747](https://tech-support.simplybook.me/letter_avatar_proxy/v4/letter/s/4bbf92/32.png) [@SJH-747](https://tech-support.simplybook.me/u/SJH-747)
#### Post date: [September 29, 2026, 3:24am UTC](https://tech-support.simplybook.me/t/client-authorization-required/2384/1 "2026-09-29T03:24:04Z")

</div>

I’m integrating with your JSON-RPC API (company login: `carinda`) via a custom Zapier automation, and I’m stuck on a `book()` call that consistently fails with the error:

**“Client authorization required”**

This error is not listed in your public Errors Handling documentation, so I’m unable to determine what’s causing it from the docs alone.

Here’s what I’ve already confirmed working correctly with the same credentials, so you can rule these out:

- `getToken(company, apiKey)` — succeeds, returns a valid token
- `getUserToken(company, adminLogin, adminPassword)` — succeeds, returns a valid user token
- `getUnitList()` — succeeds, correctly returns my provider/entertainer list
- `getAdditionalFields(eventId)` — succeeds, correctly returns my configured intake form fields (IDs 5, 6, 8, 9, 14, 16)

I have tried the following variations on the `book()` call, and every single one returns the identical “Client authorization required” error with no change:

1. Calling `book()` using only `X-Company-Login` + `X-Token` headers (from `getToken`)
2. Calling `book()` with `X-Company-Login` + `X-Token` + `X-User-Token` headers added (from `getUserToken`)
3. Calling `book()` with a fully populated `additional` parameter matching all fields returned by `getAdditionalFields`, including the required field (ID 14, “Name, email and Phone number of contact on the day of show”), formatted as an array of `{name, value, type}` objects

Since the error persists identically across all three attempts, I suspect either:

- An account-level setting is blocking or restricting API-created bookings, or
- There’s a required parameter, flag, or header on the `book()` method that isn’t covered in the public API documentation

Could someone check your server-side logs for these failed `book()` calls against my account and let me know exactly what’s triggering this error and how to resolve it?

Endpoint used: `https://user-api.simplybook.me/`  
Method: `book` (JSON-RPC 2.0)  
Company: `carinda`

Here’s the exact JSON-RPC request body my code constructs and sends for the `book()` call

json

```auto
{
  "jsonrpc": "2.0",
  "method": "book",
  "params": [
    6,
    "<unitId — the matched provider's SimplyBookMe unit ID, resolved dynamically from getUnitList>",
    "2026-10-16",
    "07:30",
    {
      "name": "STEVE",
      "email": "",
      "phone": ""
    },
    [
      { "name": "9fde671a151ef4a667665c48d9d9f7c7", "value": "STEVE", "type": "textarea" },
      { "name": "4658c825db37dad5b740456f52e00600", "value": "Music", "type": "textarea" },
      { "name": "53f4b545940e84776ac19607f571fb5f", "value": "STEVE", "type": "textarea" },
      { "name": "02e7fbb896864a2658c896a4628eccb8", "value": "Steve - Glenhaven", "type": "textarea" },
      { "name": "de2f0957cd24a48d48b4196d9dbfb6dc", "value": "STEVE / / ", "type": "textarea" },
      { "name": "632487ad04283c26a0e949e638f3eae9", "value": "", "type": "textarea" }
    ],
    1,
    null,
    null
  ],
  "id": 1
}

```

Sent to: `POST https://user-api.simplybook.me/`

Headers:

```auto
Content-Type: application/json
X-Company-Login: carinda
X-Token: <valid token obtained from getToken, confirmed working>

```

Response received:

json

```auto
{
  "jsonrpc": "2.0",
  "error": {
    "message": "Client authorization required"
  },
  "id": 1
}

```

What is the solution ?

Thank you,

---

<div class="post-metadata">

### Author: ![mib](https://tech-support.simplybook.me/letter_avatar_proxy/v4/letter/m/ec9cab/32.png) [@mib](https://tech-support.simplybook.me/u/mib)
#### Post date: [September 29, 2026, 7:23am UTC](https://tech-support.simplybook.me/t/client-authorization-required/2384/2 "2026-09-29T07:23:18Z")

</div>



---

<div class="post-metadata">

### Author: ![vetalkor](https://tech-support.simplybook.me/user_avatar/tech-support.simplybook.me/vetalkor/32/26_2.png) [@vetalkor](https://tech-support.simplybook.me/u/vetalkor)
#### Post date: [September 29, 2026, 8:56am UTC](https://tech-support.simplybook.me/t/client-authorization-required/2384/3 "2026-09-29T08:56:53Z")

</div>

Hi Steven,

Thank you for the detailed report. It made the issue easy to pinpoint.

**Cause**

The “Client authorization required” error means the Client Login feature is enabled for your company. With this feature on, the public book() method (on [https://user-api.simplybook.me/](https://user-api.simplybook.me/)) only accepts an authenticated client. Plain name/email/phone data isn’t enough, and adding X-User-Token has no effect on the public endpoint. That’s why all three of your attempts returned the same error.

**Recommended solution for a server-side integration (Zapier)**

Use the Admin API instead of the public one. You already have a working user token from getUserToken().

- Endpoint: [https://user-api.simplybook.me/admin](https://user-api.simplybook.me/admin)
- Headers: X-Company-Login: carinda and X-User-Token:

**Steps:**

1. Find the client with getClientList(searchString), or create one with addClient({name, email, phone}). This returns the client id.

2. Call book with this signature:

The admin API doesn’t require client authorization. The admin user whose credentials you use needs permission to manage bookings.

**Alternative: keep using the public API**

Pass the client’s client\_id and client\_sign inside **clientData** , where _**client\_sign = md5(client\_id + client\_hash + secret\_key)**_. New clients can be registered with signUpClient() if client registration is allowed in your Client Login settings.

Disabling the Client Login feature would also remove this check, but it affects your booking website too. Only do it if you don’t need client accounts.

**Additional fields format**

The additional parameter must be an object keyed by the field name, not an array of {name, value, type} objects:

{  
“9fde671a151ef4a667665c48d9d9f7c7”: “STEVEN H”,  
“4658c825db37dad5b740456f52e00600”: “Music”,  
“53f4b545940e84776ac19607f571fb5f”: “STEVEN H”,  
“02e7fbb896864a2658c896a4628eccb8”: “Steven H - Glenhaven”,  
“de2f0957cd24a48d48b4196d9dbfb6dc”: “STEVEN HEARN / … / …”,  
“632487ad04283c26a0e949e638f3eae9”: “”  
}

With the array format, required fields such as ID 14 would fail validation even after the authorization issue is solved. Please also pass the time as HH:MM:SS (e.g. 07:30:00).

One more tip: this is a public forum, so you may want to edit your post to remove the real email address and phone number.

Best regards,  
Vitalii  
[SimplyBook.me](http://SimplyBook.me) Team

---

<div class="post-metadata">

### Author: ![SJH-747](https://tech-support.simplybook.me/letter_avatar_proxy/v4/letter/s/4bbf92/32.png) [@SJH-747](https://tech-support.simplybook.me/u/SJH-747)
#### Post date: [September 29, 2026, 10:35pm UTC](https://tech-support.simplybook.me/t/client-authorization-required/2384/4 "2026-09-29T22:35:36Z")

</div>

Thank You Vitallii