Authentication in the CapData API

All requests to the CapData APIs must be authenticated. We use a token-based system with HTTP headers to ensure that only authorized users can access the resources.

How to Get Your Main API Key

Your main API Key is the fundamental credential for interacting with the services. Each account (Owner or independent Agency) has a unique API Key.

1. Log in to your CapData Portal.
2. On the main dashboard, you will see a section called "Your Main API Key".
3. Copy this key. This is the value you should use in the X-API-Key or X-CapData-Token header, depending on the endpoint.

Token and Header Types

Depending on the endpoint and the actor performing the action, you will need to use a specific authentication header.

X-API-Key (General API)

Used by the General API (/api/extract, /api/update_reservation). The value can be the API Key of an Owner or an Agency.

X-API-Key: your_owner_or_agency_api_key

X-Employee-Token (General API for Agents)

Used by the General API when the action is performed by an Agent. This token is created in the portal, in the "Manage My Agents" section.

X-Employee-Token: the_specific_agent_token

X-Owner-API-Key (Management API)

Used exclusively by the Management API (/api/management/*). The value MUST be the API Key of a client with the Owner role.

X-Owner-API-Key: your_owner_api_key

X-CapData-Token (Modern APIs)

This is the unified and recommended header for the newest APIs, such as the Chat API and the Transcription API. The value can be the API Key of an Owner, an Agency, or an Agent's token. The system will automatically identify the actor type.

X-CapData-Token: your_api_key_or_agent_token

SSO / Single Sign-On via Link

In addition to authentication headers, CapData offers SSO via link to open the portal already authenticated from your own systems (deep-linking). See the full guide on the SSO page.

SSO Endpoints (read-only, see guide)

• GET /auth/apikey-login?key=<CLIENT_OR_AGENCY_API_KEY>
• GET /auth/agent-apikey-login?key=<AGENT_TOKEN>

https://capdata.es/auth/apikey-login?key=xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

Best practices for using SSO links

• Always use HTTPS and avoid sharing SSO links in emails or public chats.
• Do not expose keys on the frontend: if you need a "click-to-login" link, generate a secure redirect on your server that internally resolves the API Key (do not put it in the public URL).
• Rotation and revocation: periodically rotate API Keys and revoke any compromised key.
• Usage restriction: limit who/from where can invoke these links (IP allowlist, firewalls, etc.).
• Expiration and nonce (optional): if you implement your own wrapper, add an expiration and a unique identifier per link to mitigate unwanted reuse.