---
title: "Open API: Authentication"
canonical: "https://support.vitec-hotellinx.com/space/KB/941686797/Open%20API%3A%20Authentication"
format: markdown
---
Hotellinx will provide the integrator two different keys:

1. **Public API-Key** identifies the tenant and can be shared publicly.
2. **Private API-Key** is used to calculate a token. Store this key safely on the server side in a different location than public key.

Authetication is sent on the http-request headers as follows:

```
X-API-DATE: {YYYY-MM-DD}
X-API-KEY: {Public API-key}
X-API-TOKEN: {Computed HMAC_SHA256}
```

- The API allows calls only within one day from the specified `API-DATE`. If `Date + 1 day` has passed, the calls will be dropped.
- If you request a testing environment, a separate public key will always be provided. Test public keys are prefixed with `test_` (e.g. `test_A234jja#asuuy2217`).
- Additionally, Hotellinx requires a list of IP’s and/or request origins from the requests will be made.

### Example of calculating a TOKEN

Date is “2025-02-20”, public api key “12345“ and private api key “11111“:

Token calculation:

```
HMAC_SHA256("11111","2025-02-20|12345") => 446516570507c13caeb714740d45e0d6137e85992f255d7654b559bc54005295
```

Should results as header:

```
X-API-DATE: 2025-02-20
X-API-KEY: 12345
X-API-TOKEN: 446516570507c13caeb714740d45e0d6137e85992f255d7654b559bc54005295
```

Additionally, it is preferred to send some tracking headers, which identifiers can later be used to e.g. search from logs.

```
X-Conversation-ID: xxxxxxxx
X-Session-ID: yyyy
```

> ⚠️ Please note that the current API is intended for machine-to-machine communication only. **Do not use these APIs directly in front-end code.**
> ⚠️ 
> ⚠️ Instead, use your own backend to handle communication, store data, and calculate headers and calls.