How to Integrate Replit with Mindbody

The Mindbody API requires an approved developer account before you can make any calls. Visit developers.mindbodyonline.com and apply for API access. Mindbody reviews applications — approval typically takes 1-3 business days. Once approved, you receive an API key (called a 'developer API key' in their docs) that must be included in every request as the API-Key header. In addition to your developer API key, Mindbody API v6 uses user token authentication. You authenticate by POSTing to the UserTokens endpoint with your site's staff username and password plus your developer API key. The response returns an AccessToken that you include as a bearer token in subsequent API calls. The access token has a limited lifetime and must be refreshed periodically. Collect these values before proceeding: your developer API key, the SiteId for the business you are integrating (a numeric value like -99 for the sandbox or your real site ID for production), and a staff username and password with API access permissions. In the Mindbody admin, staff accounts need the 'Access reports and information through third-party software' permission enabled. Mindbody provides a sandbox environment (SiteId -99) for testing. Always develop against the sandbox before switching to your production site ID.

Open your Replit project and click the lock icon (🔒) in the left sidebar to open the Secrets panel. You need to store four secrets: your developer API key, your site ID, and your staff account username and password. Click + New Secret and create: MINDBODY_API_KEY (your developer API key), MINDBODY_SITE_ID (the numeric site ID, e.g., -99 for sandbox), MINDBODY_USERNAME (staff account email), and MINDBODY_PASSWORD (staff account password). Each value is encrypted and injected as environment variables when your Repl starts. In Python, access them via os.environ['MINDBODY_API_KEY']. In Node.js, use process.env.MINDBODY_API_KEY. If you update any secret value while the Repl is running, stop and restart the Repl to pick up the new value. For the deployed Autoscale instance, redeploy after changing secrets. Be aware that storing staff credentials in Secrets is necessary for the OAuth token flow but does carry some security implications. Use a dedicated API service account in Mindbody rather than a real staff member's personal account, and grant it only the minimum permissions required.

1import os
2
3# Verify all required Mindbody secrets are present
4required = {
5    'MINDBODY_API_KEY': 'Developer API key from developers.mindbodyonline.com',
6    'MINDBODY_SITE_ID': 'Numeric site ID (-99 for sandbox)',
7    'MINDBODY_USERNAME': 'Staff account username/email',
8    'MINDBODY_PASSWORD': 'Staff account password'
9}
10
11for key, description in required.items():
12    val = os.environ.get(key)
13    if not val:
14        print(f'MISSING: {key} — {description}')
15    else:
16        print(f'OK: {key} ({len(val)} chars)')

The Mindbody API v6 requires a bearer token on every request. You obtain this token by POSTing to the UserTokens endpoint with your staff credentials and API key. The token expires after a set period, so your server needs to handle token refresh automatically — either by tracking expiry time and re-requesting before expiry, or by catching 401 responses and re-authenticating. The token management pattern below implements a simple caching approach: the access token and its expiry timestamp are stored in memory. Every API call first checks if the cached token is still valid; if not, it requests a new one. This avoids making unnecessary authentication requests on every API call while handling expiry gracefully. The base URL for API v6 is https://api.mindbodyonline.com/public/v6. All endpoints require two headers: API-Key with your developer API key, and Authorization: Bearer {token} with your access token. The SiteId is passed as a query parameter or header depending on the endpoint.

1# Python Mindbody API client with token caching
2import os
3import time
4import requests
5
6API_KEY = os.environ['MINDBODY_API_KEY']
7SITE_ID = os.environ['MINDBODY_SITE_ID']
8USERNAME = os.environ['MINDBODY_USERNAME']
9PASSWORD = os.environ['MINDBODY_PASSWORD']
10BASE_URL = 'https://api.mindbodyonline.com/public/v6'
11
12# Token cache
13_token_cache = {'token': None, 'expires_at': 0}
14
15def get_access_token():
16    """Return a valid access token, refreshing if expired."""
17    if _token_cache['token'] and time.time() < _token_cache['expires_at'] - 60:
18        return _token_cache['token']
19
20    response = requests.post(
21        f'{BASE_URL}/usertoken/issue',
22        headers={'API-Key': API_KEY, 'SiteId': SITE_ID},
23        json={
24            'Username': USERNAME,
25            'Password': PASSWORD
26        }
27    )
28    response.raise_for_status()
29    data = response.json()
30    token = data['AccessToken']
31    # Mindbody tokens typically valid for 2 hours (7200 seconds)
32    _token_cache['token'] = token
33    _token_cache['expires_at'] = time.time() + 7200
34    return token
35
36def mb_get(endpoint, params=None):
37    """Make an authenticated GET request to Mindbody API."""
38    token = get_access_token()
39    headers = {
40        'API-Key': API_KEY,
41        'SiteId': SITE_ID,
42        'Authorization': f'Bearer {token}'
43    }
44    response = requests.get(f'{BASE_URL}{endpoint}', headers=headers, params=params)
45    response.raise_for_status()
46    return response.json()
47
48# Fetch classes for next 7 days
49def get_classes(start_date, end_date):
50    return mb_get('/class/classes', params={
51        'StartDateTime': start_date,
52        'EndDateTime': end_date
53    })
54
55# Get client details by email
56def get_client(email):
57    return mb_get('/client/clients', params={'SearchText': email})
58
59if __name__ == '__main__':
60    from datetime import datetime, timedelta
61    today = datetime.now().strftime('%Y-%m-%dT00:00:00')
62    week = (datetime.now() + timedelta(days=7)).strftime('%Y-%m-%dT23:59:59')
63    classes = get_classes(today, week)
64    print(f"Found {classes.get('TotalResults', 0)} classes in next 7 days")

This step creates a Node.js Express server that exposes clean endpoints for class schedules and client bookings. The server manages the OAuth token lifecycle, translates simple HTTP requests into Mindbody API calls, and returns formatted JSON responses to your frontend or mobile app. The implementation below provides three endpoints: GET /classes for upcoming schedules, POST /bookings to enroll a client in a class, and DELETE /bookings/:id to cancel a booking. Each endpoint authenticates with a cached token and handles Mindbody-specific error codes (like trying to book a full class or a client who is already enrolled). Bind the server to 0.0.0.0 port 3000 — this is required for Replit's networking. Replit automatically assigns the server a public URL that you can use as your API base URL from the frontend.

1// Node.js Express server for Mindbody API
2const express = require('express');
3const app = express();
4app.use(express.json());
5
6const API_KEY = process.env.MINDBODY_API_KEY;
7const SITE_ID = process.env.MINDBODY_SITE_ID;
8const USERNAME = process.env.MINDBODY_USERNAME;
9const PASSWORD = process.env.MINDBODY_PASSWORD;
10const BASE_URL = 'https://api.mindbodyonline.com/public/v6';
11
12let tokenCache = { token: null, expiresAt: 0 };
13
14async function getToken() {
15  if (tokenCache.token && Date.now() < tokenCache.expiresAt - 60000) {
16    return tokenCache.token;
17  }
18  const res = await fetch(`${BASE_URL}/usertoken/issue`, {
19    method: 'POST',
20    headers: { 'API-Key': API_KEY, 'SiteId': SITE_ID, 'Content-Type': 'application/json' },
21    body: JSON.stringify({ Username: USERNAME, Password: PASSWORD })
22  });
23  const data = await res.json();
24  tokenCache = { token: data.AccessToken, expiresAt: Date.now() + 7200000 };
25  return tokenCache.token;
26}
27
28async function mbFetch(path, options = {}) {
29  const token = await getToken();
30  const headers = {
31    'API-Key': API_KEY, 'SiteId': SITE_ID,
32    'Authorization': `Bearer ${token}`, 'Content-Type': 'application/json',
33    ...options.headers
34  };
35  const res = await fetch(`${BASE_URL}${path}`, { ...options, headers });
36  return res.json();
37}
38
39// GET /classes?startDate=2025-01-01&endDate=2025-01-07
40app.get('/classes', async (req, res) => {
41  try {
42    const { startDate, endDate } = req.query;
43    const data = await mbFetch(`/class/classes?StartDateTime=${startDate}&EndDateTime=${endDate}`);
44    res.json(data);
45  } catch (err) {
46    res.status(500).json({ error: err.message });
47  }
48});
49
50// POST /bookings { classId, clientId }
51app.post('/bookings', async (req, res) => {
52  try {
53    const { classId, clientId } = req.body;
54    const data = await mbFetch('/class/addclienttoclass', {
55      method: 'POST',
56      body: JSON.stringify({ ClassId: classId, ClientId: clientId })
57    });
58    res.json(data);
59  } catch (err) {
60    res.status(500).json({ error: err.message });
61  }
62});
63
64app.listen(3000, '0.0.0.0', () => console.log('Mindbody API server running on port 3000'));

Deploy your Mindbody integration to Replit Autoscale for a production-ready, permanently available API. Autoscale is the right deployment type here because Mindbody API traffic is typically bursty (spikes when class schedules are viewed or during booking windows) and the service needs to be continuously available for booking confirmations. Click the Deploy button in the Replit editor, select Autoscale, and configure your run command (node index.js for Node.js or python app.py for Python). Set the machine size to at least 0.5 vCPU and 512MB RAM to comfortably handle concurrent booking requests. Your Replit Secrets are automatically available in the deployed environment. After deployment, Replit provides a stable production URL. Use this URL as the API base URL in your frontend application or Mindbody widget replacement. The URL remains constant even when the Repl is updated — you do not need to update frontend configs after redeployments. For production fitness studio integrations, configure CORS on your Express server to only allow requests from your specific frontend domain. Add rate limiting middleware to protect against accidental or malicious excessive API calls, which could exhaust your Mindbody API rate limit.

1# Example: add CORS and rate limiting to your Express server
2# Install: npm install cors express-rate-limit
3
4# In index.js, add:
5# const cors = require('cors');
6# const rateLimit = require('express-rate-limit');
7#
8# app.use(cors({ origin: 'https://yourstudio.com' }));
9# app.use(rateLimit({ windowMs: 60 * 1000, max: 100 })); // 100 req/min