Get started
Authentication and scopes
Every request authenticates with an API key that belongs to one hotel and carries a fixed set of scopes. The hotel decides which keys exist and can revoke them at any time.
Sending the key
Send the key in the Authorization header with the Bearer scheme. Keys in query strings or request bodies are not accepted.
GET /api/partner/v1/hotel HTTP/1.1
Host: app.staystryk.com
Authorization: Bearer stryk_live_Hq7bT2xa…
Accept: application/jsonKey format and storage
stryk_live_Hq7bT2xaPm4kRw9sZc3NvE6yLu8fGd2jXb5tKq7h
└────────┘└──────┘└───────────────────────────────┘
prefix key prefix remaining 32 characters
(shown in STRYK)- A key starts with
stryk_live_, followed by 40 characters from an alphabet without easily confused characters (no0,O,1,I,l,o). - STRYK shows the full key exactly once, when it is created or rotated. Afterwards only the key prefix (the first 8 characters after
stryk_live_) is visible, so you can tell keys apart. - STRYK stores only a SHA-256 hash of the key. Nobody, including STRYK support, can display a lost key again. Rotate it instead.
- Treat keys like passwords: do not log them, do not send them by email or chat.
Rotation, revocation and expiry
| Action | What happens |
|---|---|
| Rotate | STRYK creates a new key with the same name, scopes, IP allowlist, expiry and rate-limit tier and shows it once. The hotel chooses how long the old key keeps working: 24 hours by default (status “Expires soon”), after which it returns 401 unauthorized, or revoke immediately. |
| Revoke | The key stops working at once. Requests return 401 unauthorized. |
| Expiry | Optional, at most three years ahead. After the date, requests return 401 key_expired. |
For a change without downtime, the hotel rotates with the 24-hour overlap: deploy the new key within that time and check it with GET /me; the old key keeps working until then. When a key may have leaked, the hotel rotates with Revoke immediately or revokes it directly.
IP allowlist
A key can be limited to up to 20 IPv4 or IPv6 addresses or CIDR ranges, for example 203.0.113.10 or 2001:db8::/48. Requests from other addresses return 403 ip_not_allowed. Use it when your servers have fixed outbound addresses.
Scopes
Scopes decide which endpoints a key may call. Write includes read: bookings:write also allows every bookings:read endpoint; STRYK stores both. Invoices are fiscal documents and stay read-only. A call outside the key's scopes returns 403 insufficient_scope.
| Scope | Allows | Endpoints |
|---|---|---|
property:read | Hotel profile, room types and units | |
property:write | Set the housekeeping status of a unit | |
availability:read | Free units and restrictions per day | |
availability:write | Create and delete closures, inventory caps and arrival/departure restrictions | |
rates:read | Rate plans, daily prices and quotes | |
rates:write | Set and reset daily prices | |
bookings:read | List and read bookings | |
bookings:write | Create, change and cancel bookings | |
guests:read | List and read guest contact data | |
guests:write | Change guest contact data | |
payments:read | Payment status of a booking | |
payments:write | Record a bank transfer on an issued invoice (no cash or card payments) | |
invoices:read | Finalised invoices |
GET /me and GET /webhook-event-types work with every valid key.
{
"type": "https://staystryk.com/developers/errors#insufficient_scope",
"title": "Insufficient scope",
"status": 403,
"detail": "This key needs the scope bookings:write.",
"instance": "/api/partner/v1/bookings",
"code": "insufficient_scope",
"requestId": "0c8e7d6f-5a4b-4c3d-9e2f-1a0b9c8d7e6f"
}Hotel and module
The hotel is determined by the key alone; there is no hotel parameter. The hotel must be active and have the channels module enabled, otherwise requests return 403 module_disabled.