Start here

Base URL

Environment	URL
Production	https://api.theloungebooth.com
Local	http://localhost:8787

GET /health returns {"ok":true} when the Worker is up. It does not check D1.

Terms

• Event — one booking. Has a slug, a start, sometimes an end.
• Set — one station at an event. An event has at least one.
• Session — one group in front of the booth: active, completed or cancelled. A set’s queue is its active sessions, oldest first.
• Gallery — a completed session with photos. There is no gallery object; completing publishes it and sends the guests their link.
• Guest — a person in one session. Customer is that person across sessions, matched on email, else phone.

Authentication

Surface	Credential	Routes
Booth	Authorization: Bearer <BOOTH_API_KEY>	/booth/*
Kiosk, galleries, tracking, contact	none	the rest of the public routes
Staff	Better Auth cookie from /api/auth/sign-in/email	/admin/*, not documented here

One shared key for every booth machine, held as a Worker secret. Ask for it; it is not in the repo or on this site. Missing or wrong gives 401 as plain text, a malformed Authorization header gives 400.

Conventions

• JSON in and out, except presigned uploads (image/jpeg straight to R2) and POST /track (text/plain).
• Ids: 14 characters of digits and mixed-case letters, case-sensitive (7Kq2mZ0aBx91Tc). A session id is also its public gallery URL, so treat it as unguessable rather than opaque.
• Timestamps: integer Unix ms, UTC. null means unset.
• Slugs are for URLs; ids are what you send back.
• Photos are JPEG only. The server pins the content type when it signs.
• CORS is allowlisted to the admin, kiosk and site origins. Booth software is not a browser, so it does not apply.