Clinic resources · Connect · Cliniko
Cliniko · Setup guideConnect Cliniko to Zelix Labs
Create a dedicated booking user in Cliniko and generate an API key from it. The key can only do what that user can do, so it never sees treatment notes, invoices or settings.
Prefer us to set it up with you?See the two ways to set it upWhat an API key is
How Cliniko limits access
Cliniko doesn't limit a key to chosen actions. Instead, an API key has the same permissions as the user it belongs to. So the safe setup is a separate user, used by nothing else, with the lowest role that can still book appointments.
Archiving the key, or deactivating that user, cuts our access straight away.
Steps
-
Create a dedicated booking user
Sign in as a Cliniko administrator and add a new user for the booking system, for example
Zelix Labs Booking.Give it the role with the fewest permissions that can still view availability and create appointments. Your project lead will confirm the role for your setup. Never use an owner or administrator account.
-
Allow API keys for that user
Sign in as the new user, open My info and find the API keys section. Turn on the setting that allows the user to create and use API keys, then save. Cliniko asks for the user's password or passkey to confirm.
If the setting isn't available, an administrator may need to allow API keys for that user first.
-
Create the key
Open Manage API keys, add a new key and name it
Zelix Labs booking, then create it.Cliniko shows the key only once. Copy it before you click Done. The end of the key shows your Cliniko region (for example
-au2); keep it as part of the key. -
Send us the key
Send the key to us through the one-time link your project lead gives you. Please don't send keys by email or chat message: the one-time link can be opened once and then stops working.
-
Keep the off switch in mind
To stop our access at any time, archive the key in Manage API keys or deactivate the booking user.
Leave these off
| Access | Why we don't need it |
|---|---|
| Owner or administrator login | We never ask for one. A key made from an admin account could read and change everything. |
| Treatment notes and medical alerts | Booking needs only availability, appointments and patient name and phone. |
| Invoices and payments | Not part of the standard setup. If a project needs package balances, your project lead will agree an optional read-only add-on with you first. |
| Users and settings | The booking system never changes your Cliniko configuration. |
What we keep
Every patient record is cut down to name, phone and status the moment it reaches our system. Everything else, including date of birth, address, email, notes and medical alerts, is discarded before any other part of the system sees it.
On top of the limits you set here, our code carries its own fixed list of allowed actions, so a request for anything else is refused before it leaves our system. Read the full clinic security standard.
Sources
Checked against Cliniko's help documentation on 25 Oct 2026. Cliniko sometimes moves menus between releases. If your screens differ, contact your project lead and we'll go through it with you.