Klook · Authentication Profile

Klook Authentication

Authentication

Klook's Open API follows the OCTO authentication model: a single API key presented as an HTTP Bearer token in the Authorization header. Because the supplier hosts the endpoints and Klook is the calling reseller, the API keys are generated by the supplier / system provider integrating to Klook, not by Klook. Klook recommends a single unique API key per reseller-supplier relationship.

Klook secures its APIs with http across 1 declared security scheme, as derived from its OpenAPI definitions.

CompanyMarketplacesTravelTours and ActivitiesBookingExperiencesDistributionOCTOHospitality
Methods: http Schemes: 1 OAuth flows: API key in:

Security Schemes

Auth http
scheme: bearer

Source

Authentication Profile

Raw ↑ 
generated: '2026-07-19'
method: searched
source: https://klook.gitbook.io/openapi/getting-started/authentication.md
docs: https://klook.gitbook.io/openapi/getting-started/authentication.md
description: >-
  Klook's Open API follows the OCTO authentication model: a single API key
  presented as an HTTP Bearer token in the Authorization header. Because the
  supplier hosts the endpoints and Klook is the calling reseller, the API keys
  are generated by the supplier / system provider integrating to Klook, not by
  Klook. Klook recommends a single unique API key per reseller-supplier
  relationship.
summary:
  types:
  - http
  http_schemes:
  - bearer
  api_key_in: []
  oauth2_flows: []
  key_issuer: >-
    Supplier / system provider integrating to Klook (not Klook). Test keys are
    exchanged during the development-and-testing step of onboarding; live keys
    after successful testing.
schemes:
- name: Auth
  type: http
  scheme: bearer
  description: >-
    API key sent as a Bearer token in the Authorization header on every request.
  header: Authorization
  example: 'Authorization: Bearer {your_API_key}'
  sources:
  - openapi/klook-octo-openapi-original.json
  - https://klook.gitbook.io/openapi/getting-started/authentication.md
transport:
  https_required: true
  detail: >-
    All API requests must be made over HTTPS. Calls made over plain HTTP should
    fail. Requests without authentication also fail.
failure_modes:
- condition: No API key sent in the Authorization header
  error: UNAUTHORIZED
- condition: API key invalid, revoked or deactivated by the supplier
  error: FORBIDDEN
  http_status: 403
notes: >-
  The published OpenAPI applies the `Auth` bearer scheme to only three of the
  twelve operations (GET /bookings, POST /bookings/{uuid}/confirm,
  POST /bookings/{uuid}/extend); the prose documentation states authentication
  is required for all endpoints. Treat the prose as authoritative. This gap is
  captured as an enhancement in overlays/klook-octo-overlay.yaml.
related:
  conventions: conventions/klook-conventions.yml
  errors: errors/klook-error-codes.yml