OAuth 1.0 is the current authentication standard for the API. A move to a newer standard is on our roadmap: existing integrations keep working, and you will get advance notice before anything changes.
Get your credentials
D-EDGE issues your credentials during the build step of the integration journey, after the partnership agreement. Credentials are not self-served. Each integration uses two pairs of credentials. Application credentials identify your integration:- Consumer key: your public application identifier.
- Consumer secret: your private application signing key.
- Token key: identifies the hotel or group you can access.
- Token secret: signs requests scoped to that resource.
Token lifecycle
D-EDGE credentials do not expire. They remain valid until rotated.- Rotation: D-EDGE rotates credentials on request only. Contact us to plan a rotation.
- Compromised credentials: contact us immediately. D-EDGE revokes the compromised token and issues a new pair.
Sign your requests
Every request must include anAuthorization header with these OAuth 1.0 parameters:
string
required
Your application’s consumer key.
string
required
The token key for the target hotel or group.
string
required
Always
HMAC-SHA1.string
required
Unix timestamp in seconds.
string
required
A unique random string per request.
string
required
Always
1.0.string
required
HMAC-SHA1 signature of the request.
consumer_secret&token_secret. Most languages provide an OAuth 1.0 library that handles signing automatically when you supply both credential pairs.
Common pitfalls
OAuth 1.0 signing has a few subtle traps that fail silently. Watch for these when troubleshooting:- Clock skew: keep your server clock synchronised. Timestamps drifting more than a few minutes from server time are rejected.
- Nonce reuse: generate a fresh random for every request. Reusing a nonce causes a
401rejection. - URL encoding: percent-encode every parameter value before computing the signature. Unencoded special characters break the signature.