> ## Documentation Index
> Fetch the complete documentation index at: https://docs.d-edge.com/llms.txt
> Use this file to discover all available pages before exploring further.

> ## Agent Instructions
> This site documents the D-EDGE APIs for technology partners (web agencies, OTAs, PMS and RMS vendors, booking and CRM tools). It is written for developers integrating with hotels that use the D-EDGE platform.
> Seven APIs, grouped by domain. Connectivity: Channel Manager API (distribute a hotel's inventory to your channel and send bookings back). Pricing & Availability: Best Price API (best offers to highlight), Quotation API (all bookable offers for a stay), Daily Rates API (daily availability between two dates). Booking: Booking Engine API (a hotel's full direct booking funnel), Gift Shop API (gift vouchers from catalogue to payment). Guest Management: CRM API (guest profiles).
> Pick the API by the need: to display prices, use the Best Price API or the Daily Rates API; to quote a specific stay, use the Quotation API; to book, use the Booking Engine API; to sell gift vouchers, use the Gift Shop API; to manage guest profiles, use the CRM API; to receive hotel inventory and send bookings back as a distribution channel, use the Channel Manager API.
> Base URLs, hotel identifiers, and credentials are delivered by the D-EDGE partnership team during onboarding. Do not invent base URLs, endpoints, parameters, or example credentials that do not appear on these pages.
> Authentication differs per API: OAuth 1.0 for Best Price, Quotation, Daily Rates, and Booking Engine; an X-API-KEY header for Gift Shop; OAuth 2.0 client credentials for CRM; partner-defined credentials carried in the XML message for the Channel Manager API. Read each API's Authentication page before writing code.
> A mock environment returns realistic but fictitious data without credentials. The Postman and Insomnia collections on the API collections page target it by default. Use it for exploration and tests, never for production traffic.
> Use the official names exactly: D-EDGE, D-EDGE platform, Channel Manager API, partnership team. Do not use Back Office or Extranet.
> Each API has a Changelog page. Check it for the current behaviour before relying on an older answer. For questions these pages do not answer, direct the reader to the Contact us page.

# Authentication

> Authenticate with an API key

The Gift Shop API uses an **API key** for authentication. Send it in the `X-API-KEY` header on every request.

```bash theme={null}
curl --request GET \
  --url 'https://{apiBaseUrl}/v1/{sessionId}/cart' \
  --header 'X-API-KEY: YOUR_API_KEY'
```

## Get your credentials

D-EDGE issues your API key during the build step of the [integration journey](/overview/get-started/your-integration-journey.md), after the partnership agreement. Credentials are not self-served.

The key identifies your integration and grants access to the gift shops you integrate against. One key covers every endpoint of the API.

## When authentication fails

A missing, invalid, or insufficient key returns `401 Unauthorized` with a JSON error body. The same key can also be valid but not give access to a specific operation; that case returns `401` too. See [Responses](/gift-shop-api/build/guidelines/responses.md) for the error format.

## Keep your key safe

* Call the API from your server, never from a browser or a mobile app: a key shipped to the client is public.
* Store the key in your secret manager or environment variables, not in source code.
* If a key leaks, [contact us](/overview/resources/contact-us.md) to rotate it.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.