API Key Authentication & Security
The Pynath Booking API uses API keys to authenticate requests. You can view and manage your secret API keys in your dashboard under Settings Developer Keys.
Supported Authorization Headers
You can authenticate your HTTP requests using either standard Authorization: Bearer <key> or the custom x-api-key: <key> header.
// Option A: Standard Bearer Token (Recommended) Authorization: Bearer <YOUR_API_KEY> // Option B: Custom Header x-api-key: <YOUR_API_KEY>
Rate Limiting & Quotas
API request quotas are enforced via rolling token bucket algorithms:
Free Plan
60 req / min
Sufficient for low-volume scheduling & testing.
Pro Plan
600 req / min
High-throughput production sync & multi-provider teams.
Security Best Practices
- Never expose secret API keys in client-side code: Keep keys in server-side environment variables (`PYNATH_API_KEY`).
- Rotate keys periodically: Revoke old keys immediately if compromised in public repositories.
- Check HTTP 429 Responses: Respect `Retry-After` headers during automated sync jobs to avoid request throttling.