Bookings
Manage Your Booking (Customer)
Last updated 19 May 2026
Manage Your Booking (Customer)
Every booking confirmation email and SMS contains a magic link to a self-service management page. Customers can reschedule, cancel, save a card, accept counter-offers, and opt in to earlier availability — without ever creating an account.
Customer URL shape:
https://your-slug.openchairpro.com/manage/{bookingId}?token={hmac}. Custom-domain venues use their own hostname.
TL;DR
- Magic-link based — no customer account or password.
- Link in every booking confirmation (email + SMS); valid for the lifetime of the booking.
- Customer actions: view, reschedule, cancel, save card, accept counter-offer, earlier-availability opt-in.
- All plans; works on custom domains too.
What the customer experiences
- They book on your storefront (or you create a booking for them).
- Confirmation email and SMS go out with the manage link.
- They tap the link → land on
/manage/{bookingId}→ see their booking details and action buttons.
The page is bound to their booking only. They can't see other customers' bookings, your settings, or any venue-internal data. The HMAC token authenticates them to that single booking.
What's on the manage page
| Surface | What customers can do |
|---|---|
| Booking summary | Service, staff, date, time, deposit status, venue address |
| Reschedule | Browse open slots, pick a new time (subject to your venue's policy notice window) |
| Cancel | Cancel the booking (subject to policy; deposit handling applies — refund / forfeit / partial / credit per your active rule) |
| Saved card | Add a card on file (via Stripe SetupIntent), update an existing card, or remove |
| Counter-offer | If you've sent a counter-offer for a pending request, the customer accepts via this page |
| Earlier availability | Opt in to be notified if an earlier slot opens (for bookings 14+ days away) |
| Add to calendar | Downloads an .ics file |
Specific URL parameters trigger specific panels:
?panel=payment— opens the Manage Card panel directly?action=accept&offer=N— pre-accepts a counter-offer?action=reschedule— jumps straight to the reschedule flow
These are appended automatically when the relevant action surfaces in confirmation copy (e.g. counter-offer email links to ?action=accept&offer=2).
Authentication: HMAC magic-link
The token in the URL is an HMAC signature over the bookingId. The server verifies the signature on every request — if the token doesn't match, the page 404s. This means:
- The link works without sign-in
- The customer can share it with someone else (e.g. a partner managing the booking) — that person gets the same access
- Anyone who has the link has the booking-management rights
- The link can't be brute-forced — the HMAC is cryptographically signed
No time expiry at the token level. Validity is governed by booking state:
confirmed,arrived,ready_to_start,pending— link workscancelled,completed,no_show— link still renders the booking but the management actions are gone (booking is closed)
Reschedule policy
When the customer taps Reschedule, the system checks:
- Notice window — your venue's
cancellationNoticeHourssetting (default 24h) - Available slots — fetched live for the same service + staff
If the booking is inside the notice window, the customer sees: "This booking is within {N}h of the appointment time and can't be rescheduled online. Please contact {venue} directly." They can still call you or message — but they can't self-serve.
Outside the window, the slot picker opens. Pick a new time; the booking moves; a new confirmation goes out.
Cancel policy
When the customer taps Cancel:
- Notice window check runs the same way
- Deposit handling applies your venue's active deposit rule (full refund / forfeit / partial / credit / none)
- Cancellation fee can apply via the rule if configured
The customer sees the deposit outcome before they confirm cancellation: "You'll be refunded $25 to the card you paid with" or "Your $25 deposit can't be refunded per our policy" — explicit so they know what they're agreeing to.
After cancel: confirmation email + SMS go out; deposit refund (if any) processes via Stripe.
Saving a card
The Manage Card panel:
- Add card — Stripe SetupIntent flow embedded in the page
- Update card — replace the existing card
- Remove card — detach (customer-side)
Cards saved here are linked to the customer's venue record, used for walk-out checkout, cancellation / no-show fees, and saved payment methods.
Consent is captured at card-save with the manage_portal source tag.
Counter-offers
If you've sent a counter-offer (e.g. you've proposed an alternative time to a pending booking request), the customer's confirmation email includes a one-tap Accept link that lands them on the manage page with the offer pre-loaded. Tap to accept; the booking moves to the proposed time.
See Counter-Offers for the operator-side flow.
Earlier availability opt-in
For bookings 14+ days away, the manage page surfaces a prompt: "Want a slot sooner? We'll let you know if your stylist has earlier availability."
The customer picks their preferred weekdays and time bands, taps opt in. Future cancellations or new openings inside their window trigger a notification.
See Smart Waitlist for the operator-side matching engine.
What customers can't do here
- See their other bookings — each link is single-booking. There's no dashboard listing all their bookings across venues.
- Sign in with an account — no account exists; the magic link is the auth.
- Change personal details — name, email, phone are bound to the booking. To update, ask the venue to update the customer record on their side.
- Tip the stylist — tipping happens at checkout, not from this page.
- Buy gift cards — separate storefront flow (
/{slug}/gift-cards). - Book another service — go back to the main storefront to book again.
Custom domain support
If your storefront is on a custom domain, manage links use that domain too. The URL becomes https://salonsmith.com/manage/{bookingId}?token={hmac} instead of openchairpro.com/manage/....
Tier
All plans. Works for every booking on every venue.
Mobile parity
The manage page is browser-based and fully responsive — customers using their phone, tablet, or desktop all get the same surface. No native customer app required.
Common mistakes
| Problem | What to check |
|---|---|
| Customer says the link doesn't work | Confirm the booking still exists and hasn't been cancelled. Verify the link wasn't truncated in copy-paste — the token is long. |
| Customer can't reschedule | Either inside the policy notice window, or no alternative slots are available for the service + staff. They can contact you directly. |
| Customer can't cancel | Same — inside the notice window. Operator-cancel is always available from the booking detail. |
| Customer says they didn't get the confirmation email | Check Engage Activity Feed for the email status. Resend via the booking detail. |
| Need to send the customer a fresh manage link | From the booking detail (web or mobile), tap Send manage link. Generates a fresh email with the link. |
| Customer wants to manage 5 bookings at once | Not supported — each booking has its own link. They'd need 5 emails. (Customer portal is not on the current roadmap.) |
FAQ
Where does the customer get the manage link?
In every booking confirmation email and SMS. The link is signed (HMAC) so it works for the lifetime of the booking. No password, no account required — the signed URL itself authenticates the customer to that specific booking only.
What can the customer do from the manage page?
View the booking details, reschedule (subject to your policy window), cancel (subject to policy + any deposit handling), add or update a saved card, accept counter-offers you've sent, and opt in to earlier-availability notifications. They cannot see other customers' bookings or your venue settings.
What's the difference between this and a customer portal?
There's no multi-booking customer portal today — each booking has its own manage link. Customers don't sign in; they use the link from their confirmation email. Useful when you want them to action a specific booking; less useful for a customer with many bookings who wants a single dashboard.
Does the link expire?
Not by time — the HMAC isn't time-bounded. It's invalidated by booking state: cancelled and completed bookings retire the link. For active bookings, the same link works from the original confirmation through the appointment date.
What if the customer loses the email?
Operator can resend the manage link from the booking detail (web or mobile). It generates a fresh email with the same link.
Can I customise what the customer sees on the manage page?
Not today — the manage page is a standard OpenChair surface that respects your venue's policies (notice window, deposit rules) but the layout itself isn't editable.