> ## Documentation Index
> Fetch the complete documentation index at: https://docs.d-edge.com/llms.txt
> Use this file to discover all available pages before exploring further.

> ## Agent Instructions
> This site documents the D-EDGE APIs for technology partners (web agencies, OTAs, PMS and RMS vendors, booking and CRM tools). It is written for developers integrating with hotels that use the D-EDGE platform.
> Seven APIs, grouped by domain. Connectivity: Channel Manager API (distribute a hotel's inventory to your channel and send bookings back). Pricing & Availability: Best Price API (best offers to highlight), Quotation API (all bookable offers for a stay), Daily Rates API (daily availability between two dates). Booking: Booking Engine API (a hotel's full direct booking funnel), Gift Shop API (gift vouchers from catalogue to payment). Guest Management: CRM API (guest profiles).
> Pick the API by the need: to display prices, use the Best Price API or the Daily Rates API; to quote a specific stay, use the Quotation API; to book, use the Booking Engine API; to sell gift vouchers, use the Gift Shop API; to manage guest profiles, use the CRM API; to receive hotel inventory and send bookings back as a distribution channel, use the Channel Manager API.
> Base URLs, hotel identifiers, and credentials are delivered by the D-EDGE partnership team during onboarding. Do not invent base URLs, endpoints, parameters, or example credentials that do not appear on these pages.
> Authentication differs per API: OAuth 1.0 for Best Price, Quotation, Daily Rates, and Booking Engine; an X-API-KEY header for Gift Shop; OAuth 2.0 client credentials for CRM; partner-defined credentials carried in the XML message for the Channel Manager API. Read each API's Authentication page before writing code.
> A mock environment returns realistic but fictitious data without credentials. The Postman and Insomnia collections on the API collections page target it by default. Use it for exploration and tests, never for production traffic.
> Use the official names exactly: D-EDGE, D-EDGE platform, Channel Manager API, partnership team. Do not use Back Office or Extranet.
> Each API has a Changelog page. Check it for the current behaviour before relying on an older answer. For questions these pages do not answer, direct the reader to the Contact us page.

# Authentication

> Authenticate with OAuth 1.0

The Booking Engine API uses **OAuth 1.0** for authentication. Each request must be signed with HMAC-SHA1 (Hash-based Message Authentication Code using SHA-1, a cryptographic signing algorithm) using credentials issued by D-EDGE.

> [!NOTE]
>
> OAuth 1.0 is the current authentication standard for the API. A move to a newer standard is on our roadmap: existing integrations keep working, and you will get advance notice before anything changes.

## Get your credentials

D-EDGE issues your credentials during the build step of the [integration journey](/overview/get-started/your-integration-journey.md), after the partnership agreement. Credentials are not self-served.

Each integration uses two pairs of credentials.

**Application credentials** identify your integration:

* **Consumer key**: your public application identifier.
* **Consumer secret**: your private application signing key.

**Resource credentials** grant access to a specific hotel or hotel group:

* **Token key**: identifies the hotel or group you can access.
* **Token secret**: signs requests scoped to that resource.

You receive one consumer pair per integration and one token pair per hotel or group you are authorised to access. To work with multiple hotels, store every token pair and pick the right one before signing each request.

Keep all secrets confidential. Treat them as you would any password. Never commit them to source control or expose them in client-side code.

## Token lifecycle

D-EDGE credentials do not expire. They remain valid until rotated.

* **Rotation**: D-EDGE rotates credentials on request only. [Contact us](/overview/resources/contact-us.md) to plan a rotation.
* **Compromised credentials**: [contact us](/overview/resources/contact-us.md) immediately. D-EDGE revokes the compromised token and issues a new pair.

## Sign your requests

Every request must include an `Authorization` header with these OAuth 1.0 parameters:

**oauth\_consumer\_key** `string` *required*

Your application's consumer key.

**oauth\_token** `string` *required*

The token key for the target hotel or group.

**oauth\_signature\_method** `string` *required*

Always `HMAC-SHA1`.

**oauth\_timestamp** `string` *required*

Unix timestamp in seconds.

**oauth\_nonce** `string` *required*

A unique random string per request.

**oauth\_version** `string` *required*

Always `1.0`.

**oauth\_signature** `string` *required*

HMAC-SHA1 signature of the request.

The signature uses the concatenated key `consumer_secret&token_secret`. Most languages provide an OAuth 1.0 library that handles signing automatically when you supply both credential pairs.

## Common pitfalls

OAuth 1.0 signing has a few subtle traps that fail silently. Watch for these when troubleshooting:

* **Clock skew**: keep your server clock synchronised. Timestamps drifting more than a few minutes from server time are rejected.
* **Nonce reuse**: generate a fresh random nonce (A unique value used once per request to prevent replay attacks) for every request. Reusing a nonce causes a `401` rejection.
* **URL encoding**: percent-encode every parameter value before computing the signature. Unencoded special characters break the signature.

## Example request

```bash cURL theme={null}
curl --request GET \
  --url https://{apiBaseUrl}/... \
  --header 'Authorization: OAuth oauth_consumer_key="YOUR_CONSUMER_KEY",
    oauth_token="HOTEL_TOKEN_KEY",
    oauth_signature_method="HMAC-SHA1",
    oauth_timestamp="1714128000",
    oauth_nonce="abc123",
    oauth_version="1.0",
    oauth_signature="..."'
```

```javascript Node.js theme={null}
import OAuth from "oauth-1.0a";
import crypto from "crypto";

const oauth = OAuth({
  consumer: {
    key: process.env.DEDGE_CONSUMER_KEY,
    secret: process.env.DEDGE_CONSUMER_SECRET,
  },
  signature_method: "HMAC-SHA1",
  hash_function(base_string, key) {
    return crypto.createHmac("sha1", key).update(base_string).digest("base64");
  },
});

const token = {
  key: process.env.DEDGE_TOKEN_KEY,
  secret: process.env.DEDGE_TOKEN_SECRET,
};

const requestData = {
  url: "https://{apiBaseUrl}/...",
  method: "GET",
};

const headers = oauth.toHeader(oauth.authorize(requestData, token));
const response = await fetch(requestData.url, { headers });
```

```python Python theme={null}
import os
from requests_oauthlib import OAuth1Session

session = OAuth1Session(
    client_key=os.environ["DEDGE_CONSUMER_KEY"],
    client_secret=os.environ["DEDGE_CONSUMER_SECRET"],
    resource_owner_key=os.environ["DEDGE_TOKEN_KEY"],
    resource_owner_secret=os.environ["DEDGE_TOKEN_SECRET"],
)

response = session.get("https://{apiBaseUrl}/...")
```

```php PHP theme={null}
require 'vendor/autoload.php';

use GuzzleHttp\Client;
use GuzzleHttp\HandlerStack;
use GuzzleHttp\Subscriber\Oauth\Oauth1;

$stack = HandlerStack::create();

$middleware = new Oauth1([
    'consumer_key'    => getenv('DEDGE_CONSUMER_KEY'),
    'consumer_secret' => getenv('DEDGE_CONSUMER_SECRET'),
    'token'           => getenv('DEDGE_TOKEN_KEY'),
    'token_secret'    => getenv('DEDGE_TOKEN_SECRET'),
]);

$stack->push($middleware);

$client = new Client([
    'base_uri' => 'https://{apiBaseUrl}/',
    'handler'  => $stack,
    'auth'     => 'oauth',
]);

$response = $client->get('...');
```

```csharp C# theme={null}
using RestSharp;
using RestSharp.Authenticators.OAuth;

var options = new RestClientOptions("https://{apiBaseUrl}")
{
    Authenticator = OAuth1Authenticator.ForProtectedResource(
        consumerKey: Environment.GetEnvironmentVariable("DEDGE_CONSUMER_KEY"),
        consumerSecret: Environment.GetEnvironmentVariable("DEDGE_CONSUMER_SECRET"),
        token: Environment.GetEnvironmentVariable("DEDGE_TOKEN_KEY"),
        tokenSecret: Environment.GetEnvironmentVariable("DEDGE_TOKEN_SECRET"),
        signatureMethod: OAuthSignatureMethod.HmacSha1)
};
var client = new RestClient(options);

var request = new RestRequest("/...", Method.Get);
var response = await client.ExecuteAsync(request);
```

```java Java theme={null}
import oauth.signpost.OAuthConsumer;
import oauth.signpost.commonshttp.CommonsHttpOAuthConsumer;
import org.apache.http.client.methods.HttpGet;
import org.apache.http.impl.client.CloseableHttpClient;
import org.apache.http.impl.client.HttpClients;

OAuthConsumer consumer = new CommonsHttpOAuthConsumer(
    System.getenv("DEDGE_CONSUMER_KEY"),
    System.getenv("DEDGE_CONSUMER_SECRET")
);
consumer.setTokenWithSecret(
    System.getenv("DEDGE_TOKEN_KEY"),
    System.getenv("DEDGE_TOKEN_SECRET")
);

HttpGet request = new HttpGet("https://{apiBaseUrl}/...");
consumer.sign(request);

try (CloseableHttpClient client = HttpClients.createDefault()) {
    client.execute(request);
}
```


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.