Authentication

The Hotspot API authenticates with a single HTTP header: ApiKey. There is no separate login step and no token; the key is sent on every request.

Headers#

POST /public/json/customer/inhotel HTTP/1.1
Host: test.hms.gen.tr
ApiKey: 017f1daf2d139
HotelCode: 1000
Content-Length: 0

Where the key comes from#

The key is generated on the Custom API tab of the API page in the hotel’s HMS admin panel. The description field is for noting where the key is used; several keys can be generated. A key deleted on the same page becomes invalid immediately.

Failed authentication#

If the header is missing or empty, or the key is not found in HMS, the response is HTTP 401 with this body:

{
    "success": 0
}

No error detail is given. Check in this order: the header name is ApiKey, the value is exactly the key copied from the panel, and the key is still listed in the panel. Do not retry a 401; the result will not change until the key is fixed.

Hotel context#

A key is bound to one hotel; the response contains only that hotel’s guests. For an installation serving several hotels, get a key from each hotel’s own panel and store them per hotel. Sending a different HotelCode does not return another hotel’s data; the key always decides the hotel.

Protecting the key#

• Keep the key in the hotspot server’s configuration or an environment variable; never put it in the captive portal HTML or client-side JavaScript.
• The component that fetches the list must run server-side. Guest devices must not call HMS directly; the response contains identity details of every guest.
• If you suspect the key has leaked, delete it in the panel and generate a new one. The old key returns 401 the moment it is deleted.