Skip to content

Authentication

Every request to the PartnerHub API is authenticated with an API key sent in a request header. There's no OAuth flow, no tokens to refresh, and no login round-trip — a single key per environment identifies your partner account on every call.

The X-Api-Key header

Send your key in the X-Api-Key header on every request over HTTPS. A request with a missing or invalid key is rejected with 401 Unauthorized. 

curl -X GET 'https://sandbox.partner.miete24.com/api/quotes' \
  -H 'X-Api-Key: YOUR_API_KEY'

A 200 response means the key is accepted; 401 means it's missing or invalid.

Environments

PartnerHub runs two independent environments, each with its own base URL and its own API keys. A Sandbox key never works against Production, and a Production key never works against Sandbox — build and test in Sandbox, then switch to Production for live traffic.

Sandbox
https://sandbox.partner.miete24.com/api

For building and testing. Safe to experiment — no real customers or contracts.

Production
https://partner.miete24.com/api

Serves your live customers. Use only after you've tested in Sandbox.

Getting a key

You create and manage your own keys in the partner portal under API access. Choose the environment (Sandbox or Production) when you create the key. The key's value is shown once, at creation — copy it then. It's stored only as a hash and can't be retrieved later, so if you lose it you create a new one.

Key rotation

There's no separate "rotate" action — you rotate a key by creating a new one and retiring the old one, with a short overlap so nothing breaks:

  1. In API access, create a new key for the same environment.
  2. Deploy the new key to your integration and confirm it works.
  3. Revoke (or delete) the old key.

Because both keys are valid during the overlap, there's no downtime. A key can also be given an expiry date, and you'll receive a reminder before it expires so you can rotate in time. Rotate whenever a key may have been exposed, or on the schedule your security policy defines.

Keep your keys secure

An API key grants full access to your partner account. Treat it like a password:

  • Store keys as secrets (an environment variable or a secrets manager) — never in client-side code, a browser, or version control.
  • Send them only over HTTPS; the API is HTTPS-only.
  • Use a separate key per environment, and one per integration where you can, so a single leak has a small blast radius.
  • Revoke a key immediately if it may have leaked, then rotate.

What's next