The PMS API uses a key-based authentication. Every request must include a valid API key in the request header.
All endpoints require the following header:| Header | Required | Description |
|---|
X-API-Key | ✅ Yes | Your hotel-specific Guest API key or Test key |
Security Best Practices#
Never expose API keys in frontend code. All API calls should be made from your server backend, not directly from the browser or mobile app.
Store keys in environment variables. Do not hardcode API keys in source code or commit them to version control.
Use HTTPS at all times. All API endpoints are served over HTTPS. Never make requests over plain HTTP.
Modified at 2026-03-16 17:59:10
