Skip to main content
Authentication is done system-to-system via an API key, which is scoped to a specific property at a brand, so you must be sure you are sending the right key to act on data for an individual property. There are currently no brand-level authentication methods. API keys are opaque ASCII strings that you must send as a standard bearer header, as in: Authorization: Bearer <key> This API key represents YOUR system’s access to KYC data and you must protect it at all times. Never record or send it in email, Slack, or anywhere else.

​
Getting an API Key

API keys are issued by the KYC support team and will be sent to you via secure one-time-use channels.

​
Key Rotation

KYC supports key rotation on a manual or as-needed basis. For rotation, a new key will be issued and the old key will continue to work for an agreed-upon time and then disabled.

​
Authorization

Each API Key is scoped to a single property and specific endoints and actions. There permissions will be setup when your API Key is created, so if you have permission issues, please write to Support@KYCHospitality.com

​
Authentication Failures

Authentication can fail in various ways:

​
API Key Authentication Failure

​
Failures include:

  • API_KEY_NOT_FOUND - API Key Not Found - The API key did not match a valid key. This may be because the key does not exist, the key was changed, or the key is wrong.
  • INVALID_API_KEY - Invalid API Key - The API key format is not correct, such as wrong length or contains invalid characters.
  • MISSING_AUTH_HEADER - Missing Authorization Header - The Authorization header was not found.
  • INVALID_AUTH_HEADER - Invalid Authorization Header - The Authorization header was not valid, usually due to missing “Bearer ” at the start of the header.