Skip to main content
The Quotation API uses OAuth 1.0 for authentication. Each request must be signed with using credentials issued by D-EDGE.
OAuth 1.0 is the current authentication standard for the API. A move to a newer standard is on our roadmap: existing integrations keep working, and you will get advance notice before anything changes.

Get your credentials

D-EDGE issues your credentials during the build step of the integration journey, after the partnership agreement. Credentials are not self-served. Each integration uses two pairs of credentials. Application credentials identify your integration:
  • Consumer key: your public application identifier.
  • Consumer secret: your private application signing key.
Resource credentials grant access to a specific hotel or hotel group:
  • Token key: identifies the hotel or group you can access.
  • Token secret: signs requests scoped to that resource.
You receive one consumer pair per integration and one token pair per hotel or group you are authorised to access. To work with multiple hotels, store every token pair and pick the right one before signing each request. Keep all secrets confidential. Treat them as you would any password. Never commit them to source control or expose them in client-side code.

Token lifecycle

D-EDGE credentials do not expire. They remain valid until rotated.
  • Rotation: D-EDGE rotates credentials on request only. Contact us to plan a rotation.
  • Compromised credentials: contact us immediately. D-EDGE revokes the compromised token and issues a new pair.

Sign your requests

Every request must include an Authorization header with these OAuth 1.0 parameters:
string
required
Your application’s consumer key.
string
required
The token key for the target hotel or group.
string
required
Always HMAC-SHA1.
string
required
Unix timestamp in seconds.
string
required
A unique random string per request.
string
required
Always 1.0.
string
required
HMAC-SHA1 signature of the request.
The signature uses the concatenated key consumer_secret&token_secret. Most languages provide an OAuth 1.0 library that handles signing automatically when you supply both credential pairs.

Common pitfalls

OAuth 1.0 signing has a few subtle traps that fail silently. Watch for these when troubleshooting:
  • Clock skew: keep your server clock synchronised. Timestamps drifting more than a few minutes from server time are rejected.
  • Nonce reuse: generate a fresh random for every request. Reusing a nonce causes a 401 rejection.
  • URL encoding: percent-encode every parameter value before computing the signature. Unencoded special characters break the signature.

Example request