# Authentication

Learn how to authenticate your requests using API keys and manage your access credentials.

## API Key Authentication

#### Authentication Required

All StayAPI endpoints require authentication using an API key.

StayAPI uses API key authentication for all requests. You must include your API key in the `x-api-key` header with every API request.

### How to Include Your API Key

Add the `x-api-key` header to every request:

```
x-api-key: YOUR_API_KEY_HERE
```

## Getting Your API Key

1

### Sign Up for an Account

Create a free StayAPI account to get started. No credit card required for testing.

[Sign Up for Free →](/users/sign_up)

2

### Access Your Dashboard

Once logged in, navigate to your dashboard to view and manage your API keys.

3

### Generate API Key

Generate a new API key for your application. You can create multiple keys for different environments.

## API Key Security

#### Keep Your API Key Secure

Never expose your API key in client-side code, public repositories, or unsecured environments.

### Best Practices

- Store API keys as environment variables
- Use different keys for development, staging, and production
- Rotate your API keys regularly
- Never commit API keys to version control
- Use server-side requests only - never expose keys in client-side code

### Environment Variables Example

```
# .env file
STAYAPI_KEY=your_api_key_here

# In your application
api_key = process.env.STAYAPI_KEY # Node.js
api_key = os.environ['STAYAPI_KEY'] # Python
api_key = ENV['STAYAPI_KEY'] # Ruby
```

## Authentication Errors

### 401 Unauthorized

Returned when no API key is provided or the API key is invalid.

```
{
  "error": {
    "code": "unauthorized",
    "message": "Invalid or missing API key",
    "details": "Please provide a valid API key in the x-api-key header"
  }
}
```

### 429 Rate Limit Exceeded

Returned when you exceed your rate limit.

```
{
  "error": {
    "code": "rate_limit_exceeded",
    "message": "Rate limit exceeded",
    "details": "You have exceeded your rate limit. Try again later."
  }
}
```

Request

```curl
curl -X GET "https://api.stayapi.com/v1/meta/search?hotel_name=Four%20Seasons%20Resort%20Bali" \
  -H "x-api-key: sk_live_abcd1234..." \
  -H "Content-Type: application/json"
```

Response

```json
{
  "status": "success",
  "data": {
    "hotel_name": "Four Seasons Resort Bali",
    "links": {
      "booking_com": "https://www.booking.com/hotel/id/four-seasons-resort-bali-at-jimbaran-bay.html",
      "expedia": "https://www.expedia.com/Jimbaran-Hotels-Four-Seasons-Resort-Bali.h1234567.Hotel-Information",
      "hotels_com": "https://hotels.com/ho123456/four-seasons-resort-bali-jimbaran-indonesia/",
      "agoda": "https://www.agoda.com/four-seasons-resort-bali-at-jimbaran-bay/hotel/bali-id.html"
    },
    "platform_count": 4,
    "official_website_detected": true
  }
}
```

```json
{
  "error": {
    "code": "unauthorized",
    "message": "Invalid or missing API key",
    "details": "Please provide a valid API key in the x-api-key header"
  }
}
```