Authentication

All Pynath Booking API endpoints and MCP server connections require secure authentication using an API key. You can generate, manage, and rotate your API keys directly from your developer dashboard.

Bearer Token (REST API)

The required way to authenticate HTTP requests is by providing your API key as a Bearer token in the Authorization header.

cURL Example
curl -X GET https://api.pynath.com/v1/availability/slots \ 
  -H "Authorization: Bearer pyn_live_xxxxxxxxxxxxx" \ 
  -H "Content-Type: application/json"

MCP Server Authentication

When connecting an AI agent (like Claude Desktop or a custom LLM) to our Model Context Protocol (MCP) server, pass your API key as an environment variable or launch argument depending on your client.

PYNATH_API_KEY=pyn_live_xxxxxxxxxxxxx

Security Best Practices

Never Expose Keys

Never embed your API keys in client-side code (like frontend React apps or mobile apps). Always route requests through your own secure backend server.

Key Rotation

If you suspect an API key has been compromised, revoke it immediately in the Developer Dashboard and generate a new one. We recommend rotating keys annually.

Rate Limiting & Authentication

API limits are tied directly to your authenticated API Key. If a request fails authentication (401 Unauthorized), it does not count against your quota. See our API Reference for limit details.