Authentication

Doorloom staff create your integration and hand you two credentials, once. They do different jobs and rotate differently.

Your two credentials

Field	Type	Description
`API key`	string	Authenticates every call you make to Doorloom. Sent as `Authorization: Bearer <key>`.
`Webhook secret`	string, `whsec_…`	Verifies the signature on every webhook Doorloom sends you. Never sent anywhere; you only ever hash with it.

Both are shown exactly once, when the integration is created or rotated. Doorloom stores the API key hashed and the webhook secret encrypted, so neither can be read back out. If you lose one, the only path is a rotation.

One live API key

Issuing a key is rotating it. There is no second, overlapping key — the moment a new one is issued, the previous one stops working. Deploy the new key before asking for the rotation, not after.

Making an authenticated call

Request bash

curl https://api.doorloom.com/api/integrations/v1/me \
  -H "Authorization: Bearer dl_live_xxxxxxxxxxxxxxxxxxxxxxxx"

Every call needs the header. There is no unauthenticated endpoint, and no other authentication scheme — not basic auth, not a query parameter, not an IP allowlist.

Checking that it works

GET /me is the right first call. It needs no arguments, changes nothing, and tells you the state of your integration, including webhook health and the sequence number you should be caught up to.

Response 200 json

{
    "success": true,
    "message": "OK",
    "data": {
        "id": 12,
        "slug": "acme-pms",
        "name": "Acme PMS",
        "status": "active",
        "brand": {
            "id": 4,
            "name": "Amber Stays"
        },
        "api_version": "2026-09",
        "webhook": {
            "configured": true,
            "url": "https://acme.example.com/hooks/doorloom",
            "event_types": [
                "availability.changed",
                "rates.changed",
                "restrictions.changed",
                "inventory.changed",
                "property.changed",
                "booking.changed"
            ],
            "last_sequence": 1047,
            "undelivered_events": 0,
            "consecutive_failures": 0,
            "last_success_at": "2026-10-01T16:30:04+05:30",
            "last_failure_at": null,
            "paused_at": null,
            "paused_reason": null
        },
        "horizon_days": 365,
        "covered_properties": 6
    }
}

Rotating the webhook secret

Rotating the webhook secret is the gentler of the two. The previous secret keeps verifying for 24 hours. During that window every delivery carries two v1= values in its signature header, one per secret, and you should accept the payload if any of them matches.

That is what makes a rotation zero-downtime: deploy the new secret whenever you like inside the window, and neither the old build nor the new one ever rejects a real payload. The verification examples already loop over every v1=, so if you copied one of those you are already correct.

Cutting the window short

If a secret leaked and 24 hours is too long, ask Doorloom to rotate twice. The second rotation pushes the leaked secret out of the previous slot immediately.

Status, paused, disabled

Three states, and only one of them stops your API calls.

Field	Type	Description
`active`	string	Normal. API works, webhooks flow.
`paused`	string	Webhook delivery is stopped, usually because your endpoint was failing. The API keeps working. Events keep accumulating and drain in order once you recover.
`disabled`	string	Turned off by Doorloom staff. Every API call returns `403 INTEGRATION_DISABLED` and no events are recorded at all.

An integration pauses itself after five consecutive delivery failures with no success for six hours, and unpauses itself when it next answers a probe with a 2xx. See Delivery and retries.

Failures

Authentication errors

Status	Code	Meaning
401	`UNAUTHENTICATED`	No API key, or a key that is not valid. Rotating your API key invalidates the previous one immediately.
403	`NOT_INTEGRATION_TOKEN`	The bearer token is valid but is not an integration API key — it belongs to another Doorloom token surface. Integration keys are the only credential this API accepts.
403	`INTEGRATION_DISABLED`	Doorloom staff disabled this integration. No events are recorded and no API call succeeds. This is distinct from paused: a paused integration keeps full API access and only stops receiving webhooks.

A 404 on every endpoint

If every route returns a bare 404 with an empty body, the Brand Integration API is switched off for the environment you are calling. That is a platform-level flag, not something about your credentials. Ask Doorloom.