Developer docs
Authentication
API keys, how to send them, and how to keep them safe.
On this page (3)
The API uses secret keys. Send the key as a bearer token on every request:
Authorization: Bearer bw_live_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
The X-Api-Key header is accepted as an alternative for tools that cannot set Authorization.
Managing keys
Keys are created and deleted in the dashboard under Developers → API keys.
- A key is shown once, when it is created. Bewtee stores only a hash and cannot show it again.
- A business can have up to 10 active keys. Use one key per integration so you can delete one without breaking the others.
- Deleting a key takes effect immediately. Requests that use it get
401.
Keep keys on your server
Important: A key can read customer details and create or cancel bookings for the business. Never put it in website JavaScript, a mobile app, or a public repository.
To take bookings in a browser, use the booking widget, which needs no key.
What a key can reach
A key only ever sees the business it was created for. There are no scopes yet: every key has full access to that business's catalogue and bookings through this API.