Authentication | KennelBooker Developer Platform

Keep API keys private An API key grants access to business data. Store it on your server and never expose it in browser code, a public repository or a mobile application.

Get your API key

Create or copy the API key from the Developer API area of your KennelBooker business account. Each key is associated with one business and only provides access to that business's data.

Do not share one customer's key with another customer. Store a separate API key for every connected KennelBooker business.

Send the key in the request header

Add the key to the X-Api-Key header on every API request. Do not place it in the URL or query string.

Header	Value	Required
`X-Api-Key`	`kb_live_your_api_key`	Required
`Accept`	`application/json`	Recommended

Make your first request

The examples below request the bookings collection using the same API key.

Request using cURL

curl --request GET \
  --url "https://api.kennelbooker.com/api/v1/bookings" \
  --header "X-Api-Key: kb_live_your_api_key" \
  --header "Accept: application/json"

Request using C#

using System.Net.Http;
using System.Net.Http.Headers;

using (var client = new HttpClient())
{
    client.DefaultRequestHeaders.Add(
        "X-Api-Key",
        "kb_live_your_api_key");

    client.DefaultRequestHeaders.Accept.Add(
        new MediaTypeWithQualityHeaderValue("application/json"));

    HttpResponseMessage response = await client.GetAsync(
        "https://api.kennelbooker.com/api/v1/bookings");

    response.EnsureSuccessStatusCode();
    string json = await response.Content.ReadAsStringAsync();
}

Server-side JavaScript

const response = await fetch(
  "https://api.kennelbooker.com/api/v1/bookings",
  {
    method: "GET",
    headers: {
      "X-Api-Key": "kb_live_your_api_key",
      "Accept": "application/json"
    }
  }
);

if (!response.ok) {
  throw new Error(`Request failed: ${response.status}`);
}

const result = await response.json();

The JavaScript example is intended for trusted server-side code. Do not put a KennelBooker API key into JavaScript delivered to a user's browser.

Authentication errors

A valid request returns the status documented for the endpoint. If the key is missing, incorrect or no longer valid, the API returns:

401

Unauthorized The request could not be authenticated.

If you receive a 401 response

Confirm the header is named X-Api-Key.
Check that the complete key is being sent without extra spaces.
Confirm the key belongs to the business whose data you are requesting.
Replace the key if it has been exposed or is no longer valid.

API-key security checklist

Keep keys server-side Only send requests from infrastructure you control.

Use secure configuration Use environment variables or an encrypted secret store.

Do not log keys Redact the header from logs and error reports.

Replace exposed keys Treat any accidentally disclosed key as compromised.