Authentication & API keys
Account access
Use Google or an emailed six-digit code on the dashboard. Sign-in creates an account if needed. No phone number is required. Login uses a browser session; hotel API calls use an API key.
Server authentication
Authorization: Bearer hu_live_YOUR_API_KEY
Content-Type: application/jsonUse HTTPS and the base URL https://www.hoteluse.dev. Both HTTP and MCP use the same account keys and balance. A missing, invalid or revoked key returns HTTP 401.
Key lifecycle
Create a key in Dashboard → API keys. The full value is shown once and stored as a hash server-side. Label keys by application. Rotate by creating a replacement, updating your application and revoking the old key. Revocation takes effect for subsequent requests.
Keys on the same account share signup credits, prepaid balance, data access caps and rate limits. Creating another key does not create another free allowance.
Agent onboarding
An agent can read these docs without authentication, open the dashboard, guide sign-in, and help configure the key. The account owner completes any identity verification and decides where the key is stored. Never ask someone to paste a key into an issue, support email or a public prompt.