API keys

Manage secure API keys for authenticating integrations.

API Keys allow external applications to securely access Concierge APIs without relying on user credentials.

With API Keys, you can:

  • Authenticate integrations securely

  • Revoke access instantly if needed

  • Manage integrations directly from the UI

This replaces legacy authentication methods like Basic Auth, which will be deprecated on Oct 31, 2026.

Where to find API Keys

  1. Go to Admin Settings

  2. Select API Keys

Only administrators can view and manage API Keys.

Create an API Key

To create a new API Key:

  1. Click + New API key

  2. Enter a Name for the key

    • This helps identify the integration later

    • Example: PMS Integration

  3. Click Generate key

Once created:

  • The API key will be displayed one time only

  • Click Copy and store it securely

  • Click Done to finish

Important: You will not be able to view the full key again after closing the modal.

View existing API Keys

After creating a key, it will appear in the API Keys table.

Each key shows:

  • Name

  • Key (last few characters only)

  • Created date

  • Created by

  • Delete option

Keys are sorted by most recently created.

Delete an API Key

To delete an API Key:

  1. Click the delete icon next to the key

  2. Confirm deletion

Important:

  • Deleting a key will immediately revoke access

  • Any integrations using that key will stop working

How API Keys work

API Keys authenticate requests to Concierge APIs.

Supported methods:

  • X-Api-Key: <api_key>

Invalid keys return:

  • 401 Unauthorized

Security best practices

To keep your integrations secure:

  • Store API keys securely (never in client-side code)

  • Do not share keys publicly

  • Rotate keys regularly

  • Delete unused keys immediately

API keys are:

  • Stored securely (hashed)

  • Only visible once at creation

  • Fully revocable at any time

When should I create a new API Key?

Create a new key when:

  • Setting up a new integration (e.g., PMS, CRM)

  • Rotating credentials for security

  • Isolating access between systems

Best practice:Use one API key per integration

Migration from Basic Auth / JWT

API Keys are the new standard for authentication in Concierge.

  • Existing methods (Basic Auth / JWT) will only be supported temporarily

  • You should migrate your integrations to API Keys as soon as possible

Need help?

If you need assistance setting up an integration or managing API Keys, contact your Concierge administrator or support team via the Help > Chat with Us from within the web application.