Hello, This issue is currently affecting our production web applications. Existing users are unable to log in normally after IP verification was enabled.
After we generated our first User API Key, email/IP verification was automatically enabled for password-based API authentication. We have now revoked the User API Key that we created.
Before the User API Key was generated, our users were able to log in from different IP addresses using their SimplyBook username and password without any additional email/IP verification.
Is it possible to fully restore our company’s API authentication settings to the state they were in before the first User API Key was generated?
Our main goal is to restore the previous password-based login mechanism — without requiring email verification and without adding each user’s IP address individually to the Trusted IPs list.
If this cannot be done through the admin panel, is it possible for the SimplyBook API/technical team to restore it to the previous state on the server side?
Thank you for the clear description, and sorry for the disruption.
What happened: when a company generates its first User API Key, email/IP verification is automatically enabled for password-based API authentication. This is a security measure. It stays enabled after the key is revoked, and unfortunately we cannot switch it back to the previous state, either from the admin panel or on our side. And when you generated the first key, you were warned about this.
Recommended solution: authenticate with User API Keys instead of passwords. API key authentication is not subject to email/IP verification. Your applications can then log in from any IP address, and you do not need to add anything to the Trusted IPs list.
How to switch:
Generate a User API Key for each SimplyBook user your application logs in as. Keys are tied to a specific user. Each user can create their own key, and a company admin can see and manage all keys.
In your authentication request (getUserToken in the JSON-RPC API, or /admin/auth in the REST API), send the user’s login as usual and the API key in place of the password. No other changes to your integration are needed.
Store the keys securely on your server, the same way you would store passwords. Each key has an expiration date (up to 5 years), so please plan to rotate keys before they expire.
This is also more secure than storing user passwords: a key can be deactivated or revoked at any time without changing the user’s password.
If your application is used by your users to sign in with their own SimplyBook login and password, you will need to add a two-step login flow with email code confirmation:
Call POST /admin/auth (REST API) with company, login and password. If the login comes from a new IP address, the response contains require2fa: true, allowed2fa_providers: [“email”] and an auth_session_id, and the user receives an email with a verification code.
Show the user a field to enter that code.
Call POST /admin/auth/2fa with company, session_id (the auth_session_id from step 1), code and type: “email”. The response contains the access token.
After a successful confirmation, the IP address is added to the user’s trusted IPs, so the code is only requested again when the user logs in from a new location. Please note that this flow is available only in the REST API. The JSON-RPC getUserToken method returns an error in this case and does not support the second step. However, you can use the token obtained via the REST API in JSON-RPC methods, just as before.