Authentication (API Keys)

Use API Keys to authenticate to Concierge APIs.

API Keys allow external applications to securely access Concierge APIs without relying on user credentials. API Keys are the standard for authentication in Concierge. Previous methods (Basic Auth / JWT) will only be supported temporarily (as of August 2026). If you still use one of the legacy authentication methods, you should migrate your integrations to API Keys as soon as possible.

With API Keys, you can:

  • Authenticate integrations securely

  • Revoke access instantly if needed

  • Manage integrations directly from the UI

Note: This replaces legacy authentication methods like Basic Auth, which are deprecated as of summer 2026.

How API Keys work

API Keys authenticate requests to Concierge APIs.

Supported methods:

  • Authorization: Bearer <api_key>

  • X-Api-Key: <api_key>

Invalid keys return:

  • 401 Unauthorized

Find and view API Keys

To find your API keys, open the Admin Settings page, then select API Keys. Only administrators can view and manage API Keys.

Each key in the API Keys table shows the following information:

  • Name
  • Key (last few characters only)
  • Created date
  • Created by
  • Delete option

Keys are sorted by the most recently created.

Create or delete an API Key

We recommend creating a new key when:

  • Setting up a new integration (PMS, CRM, etc.)

  • Rotating credentials for security

  • Isolating access between systems

As a best practice, use only one API key per integration.

Create a new API Key

Follow the steps below to create a new API Key:

  1. In the API Keys tab of the Admin Settings page, click New API key.

  2. Enter a Name for the key.

    This helps to identify the integration later.

    Example: "PMS Integration"

  3. Click Generate key.

  4. Click Copy and store the value securely for later use.

    Once created, the API key will be displayed only once.

  5. Click Done when finished.

Important: You will not be able to view the full key again after closing the modal window.

Delete an API Key

Follow the steps below to delete an API Key:

  1. Click the delete icon next to the key.

  2. Confirm deletion when prompted.

Important:

  • Deleting a key will immediately revoke access.

  • Any integrations using that key will stop working.

Security best practices

To keep your integrations secure:

  • Store API keys securely (never in client-side code).

  • Do not share keys publicly.

  • Rotate keys regularly.

  • Delete unused keys immediately.

API keys are:

  • Stored securely (hashed)

  • Only visible once at creation

  • Fully revocable at any time

Need help?

If you need assistance setting up an integration or managing API Keys, contact your Concierge administrator or support team via the Help > Chat with Us from within the web application.