StayingAPI · Authentication Profile

Stayingapi Authentication

Authentication

StayingAPI runs two distinct auth surfaces. The REST API at api.stayingapi.com/v1 uses a Bearer API key with an environment-encoding prefix (stay_test_ = deterministic sandbox, stay_live_ = live). The hosted MCP server at mcp.stayingapi.com/mcp uses OAuth 2.1 with PKCE (S256) and dynamic client registration, advertised through RFC 8414 authorization server metadata and RFC 9728 protected-resource metadata. Both draw on the same account and the same single credit balance.

StayingAPI secures its APIs with http and oauth2 across 2 declared security schemes, as derived from its OpenAPI definitions. OAuth 2.0 is offered via the authorizationCode flow(s).

TravelHospitalityaccommodation-datahotel-apiVacation RentalShort-Term RentalAirbnbBooking.comVrbogoogle-hotelscross-ota-price-comparisonAvailabilityReviewsRESTMCPagent-nativeOpenAPI

Methods: http, oauth2 Schemes: 2 OAuth flows: authorizationCode API key in: header

Security Schemes

bearerAuth http

scheme: bearer

mcpOAuth oauth2

· flows: authorizationCode

Source

Authentication Profile

generated: '2026-08-09'
method: searched
source: openapi/stayingapi-openapi-original.json
docs: https://stayingapi.com/docs/authentication
description: >-
  StayingAPI runs two distinct auth surfaces. The REST API at api.stayingapi.com/v1 uses a
  Bearer API key with an environment-encoding prefix (stay_test_ = deterministic sandbox,
  stay_live_ = live). The hosted MCP server at mcp.stayingapi.com/mcp uses OAuth 2.1 with
  PKCE (S256) and dynamic client registration, advertised through RFC 8414 authorization
  server metadata and RFC 9728 protected-resource metadata. Both draw on the same account
  and the same single credit balance.
summary:
  types:
    - http
    - oauth2
  api_key_in:
    - header
  oauth2_flows:
    - authorizationCode
schemes:
  - name: bearerAuth
    type: http
    scheme: bearer
    surface: REST
    description: >-
      Bearer API key sent as `Authorization: Bearer <key>`. stay_test_ = deterministic
      sandbox (0 credits, synchronous); stay_live_ = live.
    key_prefixes:
      - stay_test_
      - stay_live_
    sources:
      - openapi/stayingapi-openapi-original.json
      - https://stayingapi.com/docs/authentication
  - name: mcpOAuth
    type: oauth2
    surface: MCP
    description: >-
      OAuth 2.1 authorization code + PKCE (S256) with dynamic client registration for the
      hosted MCP server. Not declared in the REST OpenAPI; discovered from the live
      /.well-known metadata on mcp.stayingapi.com.
    flows:
      - flow: authorizationCode
        issuer: https://mcp.stayingapi.com/mcp/oauth
        authorizationUrl: https://mcp.stayingapi.com/mcp/oauth/authorize
        tokenUrl: https://mcp.stayingapi.com/mcp/oauth/token
        registrationUrl: https://mcp.stayingapi.com/mcp/oauth/register
        code_challenge_methods:
          - S256
        token_endpoint_auth_methods:
          - none
          - client_secret_basic
        scopes:
          - stays.read
    sources:
      - well-known/stayingapi-oauth-authorization-server.json
      - well-known/stayingapi-oauth-protected-resource.json
      - https://stayingapi.com/docs/mcp
key_management:
  dashboard: https://stayingapi.com/dashboard/keys
  rotation: Keys can be created, labelled, rotated and revoked from the dashboard.
  storage: Secret is displayed once at creation and stored only as a hash.
  revocation: Revoked keys immediately return 401 revoked_api_key.
  verification_gate: >-
    Live credits are unusable until account email is verified; a 403 permission_denied /
    email_unverified is returned until then. Sandbox keys work throughout.
x-evidence:
  - url: https://api.stayingapi.com/openapi.json
    http_status: 200
    note: components.securitySchemes.bearerAuth
  - url: https://mcp.stayingapi.com/.well-known/oauth-authorization-server
    http_status: 200
  - url: https://mcp.stayingapi.com/.well-known/oauth-protected-resource
    http_status: 200
  - url: https://mcp.stayingapi.com/mcp
    http_status: 401
    note: >-
      WWW-Authenticate: Bearer resource_metadata="https://mcp.stayingapi.com/mcp/.well-known/oauth-protected-resource"

Work with this as data

Every security artifact here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for security posture

4 MCP tools reach this

find_securityBrowse and filter every security artifact in the catalog.
apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
resolveTurn a domain, URL or GitHub org into the provider it belongs to.
find_cohortsEvery scored population of providers in the catalog.

All 92 tools →

Call it yourself

curl for this page

This security artifact

curl "https://apis.io/api/v1/security/stayingapi-authentication"

All security posture

curl "https://apis.io/api/v1/security?limit=25"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no email required.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.