Despegar.com · Authentication Profile

Despegarcom Authentication

Authentication

Despegar.com secures its APIs with apiKey, oauth2, and mutualTLS across 3 declared security schemes, as derived from its OpenAPI definitions. OAuth 2.0 is offered via the clientCredentials flow(s).

CompanyConsumerTravelHotelsFlightsActivitiesBookingLatin AmericaB2BMCPWebhook

Methods: apiKey, oauth2, mutualTLS Schemes: 3 OAuth flows: clientCredentials API key in: header

Security Schemes

ApiKey apiKey

· in: header ()

OAuth2ClientCredentials oauth2

MutualTLS mutualTLS

Source

Authentication Profile

generated: '2026-07-18'
method: searched
source: https://api-docs.despegar.com/docs/security-scheme.md
docs: https://api-docs.despegar.com/docs/security-scheme
summary:
  types: [apiKey, oauth2, mutualTLS]
  api_key_in: [header]
  oauth2_flows: [clientCredentials]
  note: >-
    The REST B2B API uses a per-partner API key provisioned by the Despegar
    onboarding team (separate keys for test and production). The hosted MCP
    servers use OAuth 2.0 client_credentials handled server-side. Despegar also
    documents a Security API offering mutual TLS (mTLS) for B2B transactions.
schemes:
- name: ApiKey
  type: apiKey
  in: header
  description: >-
    Per-partner API key required on all B2B REST endpoints (HotelDo, Decolar,
    AfterSales, Activities). Distinct keys exist for the test and production
    environments; provisioned and scoped by the Despegar team during onboarding.
  source: docs
- name: OAuth2ClientCredentials
  type: oauth2
  flow: clientCredentials
  description: >-
    Used by the hosted B2B MCP servers (flights/hotels). Authentication is
    performed server-side; partner credentials are never exposed to the model.
  source: docs
- name: MutualTLS
  type: mutualTLS
  description: >-
    Despegar's Security API documents mTLS (Mutual TLS) as a standard for
    securing B2B transactions.
  source: docs

Work with this as data

Every security artifact here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for security posture

4 MCP tools reach this

find_securityBrowse and filter every security artifact in the catalog.
apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
resolveTurn a domain, URL or GitHub org into the provider it belongs to.
find_cohortsEvery scored population of providers in the catalog.

All 92 tools →

Call it yourself

curl for this page

This security artifact

curl "https://apis.io/api/v1/security/despegarcom-authentication"

All security posture

curl "https://apis.io/api/v1/security?limit=25"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.