Authentication

The EquipDash API uses API keys for authentication. Each API key is scoped to a specific supplier account and has its own set of permissions.

API Key Types

Live Keys

Live keys (eqd_live_*) have full read and write access:

• Create, update, and delete resources
• Access production data
• Use for production integrations

Test Keys

Test keys (eqd_test_*) are read-only:

• Read operations only (GET requests)
• Useful for development and testing
• Cannot modify data

Using Your API Key

Include your API key in the Authorization header using the Bearer scheme:

curl -X GET "https://app.equipdash.com/api/v1/bookings/123" \
  -H "Authorization: Bearer eqd_live_abc123xyz789..."

Creating API Keys

1. Log in to your EquipDash dashboard
2. Navigate to Settings > API & Integrations
3. Click Create API Key
4. Select the scopes (permissions) for this key
5. Optionally set expiration date and IP whitelist
6. Copy the key immediately (it won't be shown again)

API Key Scopes

Each API key can be granted specific scopes that control what operations it can perform:

Scope	Description
bookings:read	Read booking data
bookings:write	Create, update, delete bookings
quotes:read	View quotes
quotes:write	Create, send and decide quotes
agreements:read	View a booking's rental agreement and its PDF
agreements:write	Edit, send and sign rental agreements
products:read	Read product data
products:write	Create, update, delete products
gear:read	View the gear to pull for a booking or program
customers:read	Read customer data
customers:write	Create, update, delete customers
experiences:read	Read experiences, their sessions and the ways they are sold
experiences:write	Create and update experiences and the ways they are sold
store:read	Read store products and categories
store:write	Create, update, delete store products and categories
staff:read	Read staff data
staff:write	Manage staff
tags:read	Read tags
tags:write	Create, update, delete tags
waivers:read	Read waiver/form data
waivers:write	Manage waivers/forms
surveys:read	Read survey data and analytics
surveys:write	Submit survey responses
promotions:read	Read promotions
promotions:write	Manage promotions
marketing:read	See what marketing booked, posts and ads
marketing:write	Draft and post, change ads and marketing bots (MCP)
settings:read	Read settings
settings:write	Update settings
policies:read	Read cancellation / reschedule policies
policies:write	Create, update, delete policies (incl. tiers and applications)
reports:read	Access reports
reports:write	Create and change custom reports
webhooks:read	Read webhooks
webhooks:write	Manage webhooks
drive:read	Read Google Drive archiving connection status
drive:write	Re-archive a response to Drive and disconnect
mailchimp:read	Read the Mailchimp connection status
mailchimp:write	Change who goes to Mailchimp, sync now and disconnect

IP Whitelisting

For enhanced security, you can restrict API key usage to specific IP addresses:

1. Go to Settings > API & Integrations
2. Click on the API key to edit
3. Add IP addresses to the whitelist
4. Only requests from those IPs will be accepted

Key Security Best Practices

• Never expose keys in client-side code - API keys should only be used server-side
• Use environment variables - Don't hardcode keys in your codebase
• Rotate keys regularly - Create new keys and revoke old ones periodically
• Use minimum required scopes - Only grant the permissions you need
• Enable IP whitelisting - Restrict access to known servers

Authentication Errors

Error Code	HTTP Status	Description
authentication_required	401	No API key provided
invalid_api_key	401	API key is invalid
api_key_expired	401	API key has expired
api_key_revoked	401	API key has been revoked
ip_not_allowed	403	Request IP not in whitelist
test_key_readonly	403	Test key used for write operation
insufficient_scope	403	API key lacks required scope

Example Error Response

{
  "error": {
    "code": "authentication_required",
    "message": "No API key provided. Include your API key in the Authorization header as: Bearer YOUR_API_KEY"
  },
  "meta": {
    "request_id": "req_abc123"
  }
}