Despegar.com · Authentication Profile

Despegarcom Authentication

Authentication

Despegar.com secures its APIs with apiKey, oauth2, and mutualTLS across 3 declared security schemes, as derived from its OpenAPI definitions. OAuth 2.0 is offered via the clientCredentials flow(s).

CompanyConsumerTravelHotelsFlightsActivitiesBookingLatin AmericaB2BMCPWebhooks
Methods: apiKey, oauth2, mutualTLS Schemes: 3 OAuth flows: clientCredentials API key in: header

Security Schemes

ApiKey apiKey
· in: header ()
OAuth2ClientCredentials oauth2
MutualTLS mutualTLS

Source

Authentication Profile

despegarcom-authentication.yml Raw ↑ 
generated: '2026-07-18'
method: searched
source: https://api-docs.despegar.com/docs/security-scheme.md
docs: https://api-docs.despegar.com/docs/security-scheme
summary:
  types: [apiKey, oauth2, mutualTLS]
  api_key_in: [header]
  oauth2_flows: [clientCredentials]
  note: >-
    The REST B2B API uses a per-partner API key provisioned by the Despegar
    onboarding team (separate keys for test and production). The hosted MCP
    servers use OAuth 2.0 client_credentials handled server-side. Despegar also
    documents a Security API offering mutual TLS (mTLS) for B2B transactions.
schemes:
- name: ApiKey
  type: apiKey
  in: header
  description: >-
    Per-partner API key required on all B2B REST endpoints (HotelDo, Decolar,
    AfterSales, Activities). Distinct keys exist for the test and production
    environments; provisioned and scoped by the Despegar team during onboarding.
  source: docs
- name: OAuth2ClientCredentials
  type: oauth2
  flow: clientCredentials
  description: >-
    Used by the hosted B2B MCP servers (flights/hotels). Authentication is
    performed server-side; partner credentials are never exposed to the model.
  source: docs
- name: MutualTLS
  type: mutualTLS
  description: >-
    Despegar's Security API documents mTLS (Mutual TLS) as a standard for
    securing B2B transactions.
  source: docs