DerbySoft · Authentication Profile

Derbysoft Authentication

Authentication

DerbySoft Property Connector Integration API authentication. Access is granted with a Bearer token obtained via the OAuth 2.0 client-credentials pattern: the integrator obtains a Client ID (account_id) and Client Secret from DerbySoft (pms.service@derbysoft.net), Base64-encodes "client_id:client_secret" as HTTP Basic (RFC 7617) on the token endpoint, and receives an access token used as a Bearer token on all subsequent API calls. TLS 1.2+ over HTTPS is required.

DerbySoft secures its APIs with http and oauth2 across 2 declared security schemes, as derived from its OpenAPI definitions. OAuth 2.0 is offered via the clientCredentials flow(s).

CompanyEnterpriseTravelHospitalityHotelsDistributionConnectivityContentChannel ManagementTravel Technology

Methods: http, oauth2 Schemes: 2 OAuth flows: clientCredentials API key in:

Security Schemes

BasicTokenExchange http

scheme: basic

BearerToken http

scheme: bearer

Source

Authentication Profile

generated: '2026-07-18'
method: searched
source: https://pc.knowledgebase.derbysoftsec.com/en/support/solutions/articles/70000663114-account
docs: https://pc.knowledgebase.derbysoftsec.com/en/support/solutions/articles/70000663114-account
description: >-
  DerbySoft Property Connector Integration API authentication. Access is granted
  with a Bearer token obtained via the OAuth 2.0 client-credentials pattern: the
  integrator obtains a Client ID (account_id) and Client Secret from DerbySoft
  (pms.service@derbysoft.net), Base64-encodes "client_id:client_secret" as HTTP
  Basic (RFC 7617) on the token endpoint, and receives an access token used as a
  Bearer token on all subsequent API calls. TLS 1.2+ over HTTPS is required.
summary:
  types:
  - http
  - oauth2
  api_key_in: []
  oauth2_flows:
  - clientCredentials
schemes:
- name: BasicTokenExchange
  type: http
  scheme: basic
  description: >-
    HTTP Basic authentication per RFC 7617 used only against the token endpoint
    (POST /pcapigateway/account/token). Credentials are client_id (account_id)
    and client_secret joined with ":" and Base64-encoded.
  token_endpoint: https://pcendpoint.derbysoftsec.com/pcapigateway/account/token
  response_fields:
  - accessToken
  - tokenType
  sources:
  - https://pc.knowledgebase.derbysoftsec.com/en/support/solutions/articles/70000663114-account
- name: BearerToken
  type: http
  scheme: bearer
  bearerFormat: opaque
  description: >-
    Bearer token presented on every API request as
    "Authorization: Bearer <accessToken>". Applying a new access token expires
    all previously issued tokens immediately; the PMS must call the token API at
    least once every 90 days to refresh the token.
  refresh_interval: at least once every 90 days
  sources:
  - https://pc.knowledgebase.derbysoftsec.com/en/support/solutions/articles/70000157127-api-overview
contacts:
- pms.service@derbysoft.net
notes: >-
  The Content Distributor and Content Supplier (OTA 2016B) APIs use
  supplier/distributor credentials issued by DerbySoft rather than the Property
  Connector bearer token; their auth mechanics are not publicly documented on
  the knowledge base.

Work with this as data

Every security artifact here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for security posture

4 MCP tools reach this

find_securityBrowse and filter every security artifact in the catalog.
apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
resolveTurn a domain, URL or GitHub org into the provider it belongs to.
find_cohortsEvery scored population of providers in the catalog.

All 92 tools →

Call it yourself

curl for this page

This security artifact

curl "https://apis.io/api/v1/security/derbysoft-authentication"

All security posture

curl "https://apis.io/api/v1/security?limit=25"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.