Errors

When the API refuses a request because of the key, the problem body's type is https://bookdineplay.com/docs/api/errors/<reason> and <reason> is one of the six sections on this page. Follow the URL and you land here. Every other refusal — validation, a missing venue, a slot that is gone — is listed at the end.

missing-api-key

401. The request reached a /api/venues/** endpoint with neither an X-BookDinePlay-Key nor an Authorization: Bearer header. Most often the header was set on the wrong client instance, or a proxy stripped it. Fix: send the key on every request — see Sending a key.

{
  "type": "https://bookdineplay.com/docs/api/errors/missing-api-key",
  "title": "Unauthorized",
  "status": 401,
  "detail": "An API key is required. Send it in the 'X-BookDinePlay-Key' header or an 'Authorization: Bearer' header.",
  "traceId": "0HNOJ52B2L9BB"
}

invalid-api-key

401. A key was sent, but no active key matches it: it was mistyped, revoked in the console under Venue → API keys, or rotated and the old value is still deployed. Fix: paste the current key from the console; when rotating, deploy the new key before revoking the old one.

venue-mismatch

403. The key is valid but scoped to another venue than the {venueSlug} in the URL. Keys are per venue; a site that embeds several venues needs one key per venue (the WordPress plugin's key attribute exists for exactly that). Fix: use the key created under the venue you are calling.

origin-not-allowed

403. A publishable key was sent from an origin that is not on the key's allowlist. Typical causes: the site moved to a new domain, www versus the bare domain, http versus https, or a staging host. Fix: add the exact origin (scheme, host, and port if any) under Venue → API keys, or add a :* port wildcard for local development — see Origins.

{
  "type": "https://bookdineplay.com/docs/api/errors/origin-not-allowed",
  "title": "Forbidden",
  "status": 403,
  "detail": "This origin is not on the API key's list of allowed origins.",
  "traceId": "0HNOJ52B2L9BD"
}

secret-key-from-browser

403. A secret key (bdp_sk_…) arrived together with an Origin header, which only browsers send. A secret key in a browser is a published secret, so the request is refused outright rather than served. Fix: revoke that key now, create a publishable key for the browser, and keep secret keys on the server.

publishable-key-without-origin

403. A publishable key (bdp_pk_…) arrived without an Origin header. Publishable keys are protected by their allowlist, and without an origin there is nothing to check against. This is what a server-side call with a publishable key looks like. Fix: use a secret key on the server; if the call really comes from a browser, the Origin header is added automatically — a missing one means the request was not made by a browser.

Problems without a reason code

These carry the generic RFC 9110 type; detail says what happened.

Next steps

• Authentication — the same refusals from the key's point of view.
• API reference — the problem body format.