Planning Center API: Full Access on the Free Tier
A first-time guest who fills out a connection card on Sunday should not wait until Thursday for someone to work the list. Carly can follow up that day. It can also acknowledge gifts, chase volunteer confirmations, notice attendance changes, update tasks and calendars, and give ministry leaders a recurring brief of the people who need attention.
Planning Center gives you the complete API on the free tier. Their docs say it outright: “You can access the full API on the free subscription tiers, and also add sample data for you to work with.” No plan gate, no developer program, no sales call. A church paying nothing can run API automation today.
That’s unusual enough to lead with, because most church management software treats integration as an enterprise upsell. Here’s the rest of what’s actually true.
What churches actually automate with it
The jobs that come up most, and that usually depend on a volunteer remembering:
- First-time guest follow-up within the day. Someone new fills out a connection card on Sunday and gets a warm email that evening, rather than the following Thursday when someone finally works through the list.
- Giving acknowledgements that go out immediately, in the giver’s name, with the right fund — instead of a batch someone processes at month end.
- Volunteer scheduling reminders that chase the people who haven’t confirmed for Sunday, without the coordinator texting each one.
- Lapsed-attender flags — a regular family stops checking in, and someone gets told while it’s still a two-week gap rather than a three-month one.
All of that runs on the free tier, which is genuinely unusual for church software.
Getting a token
Go to https://api.planningcenteronline.com/personal_access_tokens, log in, and click Create a new Personal Access Token. You get a client_id and secret, used as HTTP Basic auth:
curl -u client_id:secret https://api.planningcenteronline.com/people/v2/peopleA Personal Access Token is single-organization by design. Planning Center is explicit: “You may not use a Personal Access Token if you are integrating with multiple churches—instead use OAuth.” If you’re building something for one church — yours — a PAT is the right tool. If you’re building a product for many churches, you register an OAuth Application instead.
The rate limit is more generous than most write-ups claim
100 requests per 20 seconds per authenticated user, which works out to roughly 300 a minute. You’ll see “100 per minute” repeated in a lot of places; that’s wrong.
Requests with an offset above 30,000 drop to 75 per 20 seconds. Exceeding returns a 429 with Retry-After in seconds, and every response carries X-PCO-API-Request-Rate-Limit, -Rate-Count, and -Rate-Period headers so you can see where you stand.
The docs also warn against hardcoding any of this: limits get adjusted dynamically and individual endpoints may sit lower. Read the headers.
Which modules you can actually write to
All eight product modules have APIs, but write coverage varies a lot — and two of them are read-only, which is the thing most likely to sink a plan late:
| Module | Writable | Notes |
|---|---|---|
| People | Yes, full CRUD | 67 endpoints, the richest surface |
| Services | Yes, full CRUD | 65 endpoints |
| Giving | Yes | Donations, batches, pledges, funds |
| Publishing | Yes | Episodes, series, channels |
| Calendar | Partial | Resources and tags writable — events and bookings are read-only |
| Groups | Barely | Only group, membership, and group application |
| Check-Ins | No | Read-only |
| Registrations | No | Read-only |
So “automatically check someone in” and “create a registration through the API” are both off the table. Reading that data and acting on it elsewhere is fine.
One documentation note: planningcenter.com/developers is stale and lists only six modules, omitting Publishing and Registrations entirely. Use api.planningcenteronline.com/docs/apps as the real index.
Webhooks exist, but the event list isn’t published
Planning Center does not publish a catalog of webhook events anywhere. This isn’t an oversight you can work around by searching harder — the list is served at runtime, behind auth.
You enumerate it yourself:
curl -u client_id:secret \
'https://api.planningcenteronline.com/webhooks/v2/available_events?per_page=100'Each AvailableEvent carries app, resource, action, name, type, and version, which confirms the naming grammar is {app}.v2.events.{resource}.{action}. The events that appear in official documentation are people.v2.events.person.created, people.v2.events.person.updated, people.v2.events.list_result.created, and services.v2.events.plan.live.updated.
Webhook coverage is not the same as API coverage. Webhooks launched for People only in 2017; Giving gained them in 2021. Whether Check-Ins, Groups, Calendar, or Registrations fire events is genuinely unclear from public sources, and there are open requests asking for Check-Ins webhooks — which suggests they don’t. Run the available_events call before you design around any specific event.
That matters especially for Check-Ins and Registrations: since both are read-only in the REST API, a webhook would be the only way to act on them in real time.
Mechanics, once you have one: subscriptions are created in the UI at api.planningcenteronline.com/webhooks. Payloads are signed with HMAC-SHA256 in X-PCO-Webhooks-Authenticity, keyed on the subscription’s authenticity_secret. Retries run up to 16 times over four days, a 410 deactivates the subscription, and 429/503 with Retry-After are honored for up to an hour.
The trap that makes integrations quietly wrong
A Personal Access Token inherits its creator’s permissions, and failures are silent.
Planning Center has no service-account concept — “all requests to our API are made on behalf of a user,” and your integration “will act under the permission levels your user account has.” A PAT created by a volunteer with limited People access doesn’t return a 403 on records they can’t see. It returns a truncated dataset. Your sync appears to work perfectly while missing people.
Two consequences worth designing around: create the token under an account with the access the integration actually needs, and remember that the token dies with the person’s account. When that staff member leaves, every integration built on their PAT stops.
Three more, briefly:
- Per-app date versioning, with equal-or-less matching. Set
X-PCO-API-Version: YYYY-MM-DD. Request a date that doesn’t exist and you silently get the nearest earlier version, no warning. “Current” differs wildly by module — People is on 2026-06-04 while Services is still on 2018-11-01. Anything before 2018-08-01 returns a 400, andLATESTis explicitly not recommended for production. - Deep pagination is penalized twice.
per_pagecaps at 100 (default 25), and crossing offset 30,000 also cuts your rate limit. Usewhere[]filters on timestamps and?include=to collapse related fetches instead of paging blindly through a large database. - Writes need the JSON-API envelope. Payloads must be wrapped as
{"data": {"attributes": {...}}}or they’re rejected.
Getting the event to do something
An event stream is only worth having if something acts on it. A new person in People, a completed plan in Services, a gift in Giving — each is a moment where a follow-up should happen, and in most churches it happens when a volunteer remembers.
Handing that to an AI assistant hits a specific wall.
Both ChatGPT Scheduled Tasks and Claude Cowork can do unattended work on a timer. Neither ordinary scheduler is a general webhook or business-app event listener. ChatGPT Workspace Agents accept API triggers, but only after an upstream service notices the event.
“Summarize last month’s giving” is well within what ChatGPT or Claude will do with a Planning Center export. “Send the welcome sequence within an hour of someone first checking in” is not, because nothing on that side is watching for the check-in.
Carly is built for that half:
- Fires on the Planning Center event — a new person, a gift, a plan going live
- Runs the whole follow-up in one flow — read the record, draft the message, send it, log what happened
- Actually sends — Gmail and Outlook, with attachments
- Handles the read-only modules sensibly — if Check-Ins can only be read, a scheduled sweep plus an alert is the honest design, and that’s a job worth automating
Because Planning Center exposes a public API, you can connect it natively to Carly from the Integrations tab with your API credentials. Carly can then use Planning Center in on-demand, recurring, and event-triggered workflows. AI agents start at $35/month, and workflow steps that don’t use AI run free.
Frequently Asked Questions
Do I need a paid Planning Center plan to use the API?
No. Planning Center’s docs state that the full API is available on free subscription tiers, and sample data is available too. Paid tiers raise product usage caps — daily check-ins, monthly donations, Services team members — not API access.
How do I get a Planning Center API key?
Visit api.planningcenteronline.com/personal_access_tokens, log in, and create a Personal Access Token. You get a client ID and secret used as HTTP Basic auth. Use OAuth instead if you’re integrating with more than one church.
What is the Planning Center API rate limit?
100 requests per 20 seconds per authenticated user, dropping to 75 per 20 seconds once your offset passes 30,000. Responses include rate-limit headers, and the docs advise reading those rather than hardcoding numbers.
Which Planning Center modules are read-only?
Check-Ins and Registrations have no write endpoints. Calendar is mostly read-only — resources and tags can be written, but events and bookings cannot. Groups only supports writes on groups, memberships, and applications.
What webhooks does Planning Center support?
Planning Center doesn’t publish an event catalog. You enumerate the available events at runtime with an authenticated call to /webhooks/v2/available_events. Documented examples cover person created and updated, list results, and Services plans going live.
Why is my Planning Center integration missing records?
Most likely the token’s permissions. Personal Access Tokens act as the user who created them, and insufficient access silently truncates results rather than returning an error. Recreate the token under an account with the access the integration needs.
More: Best AI tools for churches · AI agents for nonprofit directors · Best AI assistant for nonprofits
Ready to automate your busywork?
Carly schedules, researches, and briefs you—so you can focus on what matters.
See what people say
"Before Carly, I relied on a Calendly link, but the whole process felt impersonal and not very professional. Carly changed that by handling all the back-and-forth, so I'm no longer stuck in endless email threads trying to line up schedules.
Now Carly reaches out to candidates, shares my real-time availability, lets them pick a slot, then sends a Zoom link and drops it straight into my calendar. She sends reminders to both of us before each call, which has significantly reduced no-shows and last-minute confusion.
On top of scheduling, Carly acts like a full executive assistant, sending me my schedule the night before so I can prepare for each call. It reminds me of the old x.ai assistant, but Carly is noticeably smarter, faster, and better suited to my healthcare recruitment business."
