Put your field bookings anywhere.

Overview

Everything here belongs to one venue. Its owner (or StrikerLeagues support) turns things on in My venues → your venue → Integrations:

• Booking widget

  Free times on your own website. No coding: paste one snippet.

• Read-only API

  Your fields, free times, bookings and blocks, as JSON, with an API key.

• Webhooks

  A signed POST to your server when a booking is confirmed, requested, declined or cancelled.

• Calendar feeds

  Bookings in Google, Outlook or Apple Calendar, and busy times from your calendars blocking bookings.

Booking and paying always happen on StrikerLeagues, signed in, so card details never touch your site. The API reads; it doesn’t create or change bookings.

Booking widget

Copy your venue’s snippet from Integrations → Booking widget, or write it yourself with your venue’s page name (the part after /fields/ in its booking link):

<div data-strikerleagues-venue="zilker-park-soccer-fields-austin"></div>
<script src="https://www.strikerleagues.com/widget.js" async></script>

The widget shows the next two weeks of free times and resizes itself to fit. Choosing a time opens your StrikerLeagues page in a new tab with that time picked, where the player signs in and pays. Options go on the div:

Site builders that don’t allow scripts can use a plain iframe instead (set the height yourself):

<iframe src="https://www.strikerleagues.com/embed/fields/zilker-park-soccer-fields-austin?theme=dark"
  title="Book on StrikerLeagues" loading="lazy"
  style="width:100%;max-width:640px;height:560px;border:0;border-radius:16px"></iframe>

API keys

The venue’s owner makes keys in Integrations → API & webhooks. A key starts with sl_live_, is shown once, and reads that venue only. Send it in the Authorization header (or X-Api-Key):

curl https://strikerledger-production.up.railway.app/api/v1/open/bookings \
  -H "Authorization: Bearer sl_live_…"

Keys read bookings and bookers’ names. Use them from your server only, never in a web page or an app people can download. Revoke a key in the Integrations tab if it leaks.

All times are UTC (ISO 8601). Money is in the smallest unit (cents) with its currency. The venue’s time zone is in /venue.

Errors and limits

Every response has the same shape. Errors use the HTTP status plus a code you can check:

{
  "success": false,
  "error": { "code": "API_KEY_INVALID", "message": "That API key isn’t valid (it may have been revoked)." },
  "meta": { "timestamp": "2026-11-06T15:04:53.093Z" }
}

Each response carries X-RateLimit-Limit, X-RateLimit-Remaining and X-RateLimit-Reset (seconds until the minute resets). To keep in sync, prefer webhooks over polling, or poll /bookings?updatedSince=… every few minutes.

Endpoints

Base URL: https://strikerledger-production.up.railway.app/api/v1/open

{
  "success": true,
  "data": {
    "timeZone": "America/Chicago",
    "durationMinutes": 60,
    "bookingUrl": "https://www.strikerleagues.com/fields/zilker-park-soccer-fields-austin",
    "fields": [
      {
        "id": "1b3bd028-…",
        "name": "Field 1",
        "gameFormats": ["7v7", "11v11"],
        "slots": [
          { "startsAt": "2026-11-16T23:00:00.000Z", "endsAt": "2026-11-17T00:00:00.000Z", "price": { "amount": 9500, "currency": "usd" } }
        ]
      }
    ]
  }
}

{
  "id": "4034ef5c-5693-402a-ba1b-696611958ec1",
  "status": "confirmed",
  "field": { "id": "1b3bd028-4027-4e9b-9d4c-3da97d4e31d7", "name": "Field 1" },
  "startsAt": "2026-11-18T00:00:00.000Z",
  "endsAt": "2026-11-18T01:00:00.000Z",
  "gameFormat": "7v7",
  "price": { "amount": 12000, "currency": "usd" },
  "booker": { "name": "Pat Player" },
  "series": null,
  "leagueMatchId": null,
  "cancelledAt": null,
  "cancellationReason": null,
  "createdAt": "2026-11-06T15:05:56.000Z",
  "updatedAt": "2026-11-06T15:05:56.000Z"
}

Webhooks

Add up to five https endpoints in Integrations → API & webhooks, choose their events, and use Send test to try one. We POST JSON like this:

StrikerLeagues-Event: booking.confirmed
StrikerLeagues-Delivery: 9d0c3f9e-…
StrikerLeagues-Signature: t=1793977556,v1=5f1c0b…
Content-Type: application/json

{
  "id": "evt_9035cf198177d85cfd34b50f",
  "type": "booking.confirmed",
  "created": "2026-11-06T15:05:56.681Z",
  "venueId": "2781d6fe-ac44-4c18-9a39-f1b86f83e1b5",
  "data": { "booking": { …the booking, as in the API… } }
}

Events

A weekly booking sends one event per week’s booking. Events can arrive out of order, so compare updatedAt if order matters.

Checking signatures

Each endpoint has a signing secret (whsec_…, shown in the Integrations tab). StrikerLeagues-Signature holds a Unix timestamp t and v1, the hex HMAC-SHA256 of "<t>.<raw body>" with your secret. Check it against the raw body, reject old timestamps, and compare in constant time:

import crypto from 'node:crypto';
import express from 'express';

const app = express();
const SECRET = process.env.STRIKERLEAGUES_WEBHOOK_SECRET; // whsec_…

// Use the raw body: re-serialised JSON won't match the signature.
app.post('/strikerleagues/webhook', express.raw({ type: 'application/json' }), (req, res) => {
  const header = req.get('StrikerLeagues-Signature') || '';
  const parts = Object.fromEntries(header.split(',').map((p) => p.split('=')));
  const t = Number(parts.t);
  const expected = crypto.createHmac('sha256', SECRET).update(`${t}.${req.body}`).digest('hex');
  const fresh = Math.abs(Date.now() / 1000 - t) < 300; // 5 minutes
  const valid =
    fresh && parts.v1?.length === expected.length &&
    crypto.timingSafeEqual(Buffer.from(parts.v1), Buffer.from(expected));
  if (!valid) return res.sendStatus(400);

  const event = JSON.parse(req.body);
  // Events can arrive more than once: skip ids you've already handled.
  if (event.type === 'booking.confirmed') {
    // event.data.booking …
  }
  res.sendStatus(200); // answer fast; do slow work afterwards
});

Retries

• Answer with any 2xx within 10 seconds. Redirects aren’t followed.
• Otherwise we try again after 1 minute, 5 minutes, 30 minutes, 2, 6, 12 and 24 hours: eight tries in all.
• The same event can arrive more than once. Use its id to skip repeats.
• After 50 failed tries in a row an endpoint is switched off. Fix it, then switch it back on in the Integrations tab.
• The last 25 deliveries per endpoint, with their payloads, are listed under Recent deliveries (kept for 30 days).

Calendar feeds

Integrations → Calendar sync gives each venue a private iCal link (all fields, or one per field) of bookings, requests and blocks. Calendar apps check it every 30 minutes or so. Anyone with the link can read it, so it can be reset there.

The same page imports other calendars (Google, Outlook, iCloud, another booking system) by their iCal link: their events block the fields you choose, re-checked every 30 minutes, 180 days ahead. Imported busy times show in /blocks as imported_calendar.

Help

Stuck, or need something the API doesn’t do yet? Use Help in the app or contact support. By using the API you agree to our Terms, including keeping players’ details private.