Authentication

Send your key in the Authorization header:

Authorization: Bearer dyme_live_YOUR_KEY

The same key works for the MCP server.

Without a key

You can call the API without a key, at 30 requests an hour per IP address. That works from a browser too, since keyless responses carry Access-Control-Allow-Origin: *. Links in keyless responses don't carry an affiliate code (they carry utm_source=dyme_api_demo), so nobody is credited for bookings from them. It's for trying things out.

Getting a key

Apply at dyme.earth/affiliates; approved affiliates can ask for an API key. Keys come at the standard tier (2,000 requests a day). If you need more, say so and we'll set you up on the partner tier (20,000 a day).

A key looks like dyme_live_ followed by 32 characters.

Keeping it safe

• Keep the key on your server, in a secret or an environment variable.
• Don't put it in client-side code, in a widget address, or in a public repository. Widgets don't take a key at all, only your affiliate code.
• If a key leaks, email us and we'll issue a new one and revoke the old one.

A browser can't send a key. The API doesn't allow the Authorization header in a cross-origin request, so a keyed call from a web page fails before it's sent. To show hotels on a page, call the API from your server (a server-rendered page, or a small route of your own that the page calls), or use the widgets.

When a key isn't read

A key we can't use doesn't cause an error. The request is served as if there were no key: the keyless limit applies (30 an hour, then 429), and links carry utm_source=dyme_api_demo and no _from, so nothing is credited to you. The response header X-Dyme-Key-Status says why. It's absent when the key worked.

X-Dyme-Key-Status	Meaning
none	No key arrived. Check the header is exactly Authorization: Bearer dyme_live_…; a key sent without Bearer counts as no key.
unknown	We don't recognize the key. Check for a typo or a stray space.
pending	The key exists but isn't active yet.
rejected	The application behind the key wasn't approved.
revoked	The key was replaced or withdrawn. Use the newest one we sent.

X-RateLimit-Limit tells you the same thing at a glance: 30 means you're being served as keyless.

Errors

Errors are JSON with a code and a message:

{ "error": { "code": "rate_limited", "message": "…" } }

Status	Code	Meaning
400	invalid_params	A required parameter is missing or wrong.
404	not_found	No hotel or place matched.
429	rate_limited	You're over the limit. See rate limits.
503	upstream_unavailable	Our hotel data supplier didn't answer. Retry after the Retry-After header (60 seconds).

A wrong or missing key never returns 401; see when a key isn't read.