Beyond Pricing · Authentication Profile

Beyond Pricing Authentication

Authentication

Beyond Pricing secures its APIs with http and oauth2 across 2 declared security schemes, as derived from its OpenAPI definitions. OAuth 2.0 is offered via the clientCredentials flow(s).

CompanyShort-Term RentalsVacation RentalsRevenue ManagementDynamic PricingHospitalityProperty ManagementTravelPricingJSON:API
Methods: http, oauth2 Schemes: 2 OAuth flows: clientCredentials API key in:

Security Schemes

oauth2 oauth2
· flows: clientCredentials
personalAccessToken http
scheme: bearer

Source

Authentication Profile

Raw ↑ 
generated: '2026-07-18'
method: searched
source: openapi/beyond-pricing-openapi-original.yml
docs: https://developers.beyondpricing.com/getting-started/authentication/
standards:
- RFC 9700 (OAuth 2.0 Security Best Current Practice)
- RFC 8414 (OAuth 2.0 Authorization Server Metadata)
authorization_server_metadata: https://developers.beyondpricing.com/.well-known/oauth-authorization-server
notes: >-
  Partners use OAuth2 client-credentials on a confidential client; access tokens
  expire after 1 hour and can be narrowed with user_id (user-scoped) and
  credential_id (credential-scoped). Individual users use self-service personal
  access tokens (bpat_ prefix) created in the Beyond dashboard, sent as
  Authorization: Bearer. IP allowlists can be enforced per application.
summary:
  types:
  - http
  - oauth2
  oauth2_flows:
  - clientCredentials
schemes:
- name: oauth2
  type: oauth2
  flows:
  - flow: clientCredentials
    tokenUrl: /o/token/
    scopes: 9
  description: Use OAuth2 client credentials to mint an application token, or add `user_id`
    and optional `credential_id` in the Authorize dialog to request a user- or credential-scoped
    token.
  sources:
  - openapi/beyond-pricing-openapi-original.yml
- name: personalAccessToken
  type: http
  scheme: bearer
  bearerFormat: PersonalAccessToken
  description: Paste a `bpat_...` personal access token. PATs use the same Bearer header as
    OAuth2 tokens and must still include the runtime-required scopes for each endpoint, even
    though OpenAPI cannot encode scopes for non-OAuth bearer schemes.
  sources:
  - openapi/beyond-pricing-openapi-original.yml