Help & developers
On this page and tools
Checked against the live API on October 10, 2026.
Report an error on this pageStart here
Migrating from the legacy endpoint
Three older ways of connecting are being retired. The ?key= endpoint and employee tokens were switched off on 11 October 2026, and older widget keys were switched off on 20 October 2026. Everything they did has a current replacement, and most migrations take a few minutes.
Sunset header. From those dates they answer with HTTP 410 and the error code
legacy_key_retired. Move to a current key rather than waiting.
What is going away
| If you use… | Replace it with… |
|---|---|
The open-data endpoint GET /api/resources with ?key= or an X-API-Key header |
GET /dash/api/v1/resources with a developer key (bapi_pk_…) in the Authorization header. |
An employee token on /dash/api/resources |
A team key (bapi_tk_…) with the directory management permission. |
| A widget key in your embed snippet | A browser key (bapi_pk_…) made from your Space, or a team key (bapi_tk_…) with the embed:widget scope, in data-key. |
Open-data reads
- Open /dash/developers/keys and create a developer key. Keys you already hold were carried over and work as bearer tokens; if one is rejected, create a new one.
- Change the URL from
/api/resourcesto/dash/api/v1/resources. - Move the key out of the query string and into the header:
Authorization: Bearer bapi_pk_…. - Switch paging from
offsettocursor, and read results fromdatainstead ofresources. The full shape is on Resources — read.
curl "https://bynefit.com/api/resources?key=YOUR_KEY&category=food"
curl "https://bynefit.com/dash/api/v1/resources?category=food" \ -H "Authorization: Bearer bapi_pk_…"
What changes, field by field
Nothing is removed from an entry. The new endpoint returns every field the old one did, and adds a few. Anything you send that the new endpoint does not know is ignored.
Old /api/resources | New /dash/api/v1/resources | Notes |
|---|---|---|
?key= or X-API-Key | Authorization: Bearer bapi_pk_… | A legacy key in the query string is refused from 20 October 2026. A bapi_ browser key in the query string keeps working. |
category | category | Same twelve values. |
limit (up to 500, default 100) | limit (up to 200, default 50) | Ask for more pages instead of a bigger page. |
offset | offset, or cursor | offset still works. cursor is steadier while entries are being added. Use one or the other. |
| Most upvoted first | sort=popular | The default is now newest first. Add sort=popular for the old order. It pages with offset. |
| Not available | since | Only entries added on or after an ISO-8601 time. |
data | data | Same. |
count, total, has_more | count, total, has_more | Same meaning, except total reads "10000+" above 10,000 and is left out when you use offset. Use has_more to stop paging. next_cursor is new. |
byn_id | byn_id, and id as res_ plus the same value | Either identifies the entry. |
registered_on, go_website, go_phone, upvote_count | Same names | Same values. |
name, description, category, address, phone, website, hours | Same names | Same values. |
| Not available | type | Always resource. |
meta.description | Not returned | The rest of meta is the same. |
| Errors as text | Errors as a short error code | Codes are listed on Resources — read. |
| No call limit | A limit per key per hour, in X-RateLimit-Limit | Read X-RateLimit-Remaining and wait for Retry-After on a 429. |
Calling from a web page works too: the endpoint answers the browser's preflight check for the
Authorization header from any website.
One transition allowance: a legacy key still works in the ?key= address on
GET /dash/api/v1/resources, and only there, so that embedded directory pages keep loading. It is
read-only, limited to the public directory and to the public rate limit. It was switched off on 20 October 2026;
after that, send the key as Authorization: Bearer.
Directory management
Create a team key at
/dash/integrations/api-tokens
and send it as Authorization: Bearer bapi_tk_… to the same
/dash/api/resources endpoints described on
Resources — manage. The directory
management permission is approved for one Space at a time: an admin of the
Space chooses Request access next to Manage your directory
on that page, and Bynefit emails the answer, usually within one business day.
Once it is approved, tick it when you make the team key.
Embed widget
The quickest way is the Embeds page: open /dash/integrations/embeds and choose Copy the new snippet under "Copy the new snippet for your embed". It makes a browser key and shows the whole snippet once. Paste it where the old snippet was. Your allowed sites carry over, and the old key keeps working until 20 October 2026.
<script src="https://bynefit.com/widget.v2.js" data-key="wk_…"></script>
<script src="https://bynefit.com/widget.v2.js" data-key="bapi_pk_…"></script>
You can also make the key yourself: on /dash/integrations/api-tokens choose Create key and
Run in a visitor's browser to make a browser key, which is safe in a page and follows the allowed
sites on your Embeds page. Or create a team key with embed:widget (see
Embed widget), then put it in the
data-key attribute of your script tag in place of the old
widget key. Redeploy the page now: an embed still using the old key gets a 410 error.
Resource directory widget
The resources-widget.js directory script sends your key in the Authorization header to
/dash/api/v1/resources. Put a developer key (bapi_pk_…) from
/dash/developers/keys in its data-key. List your website on the key so other sites cannot use it.
A key you already held for the old address keeps working as data-key; if it is refused, make a new one.
The directory allows 60 calls an hour per key.
<div id="bynefit-resources"></div> <script src="https://bynefit.com/resources-widget.js" data-key="bapi_pk_…"></script>
Check you are done
- Your responses no longer carry a
Sunsetheader. - No page or server on your side still contains
?key=,X-API-Key, or an old widget key.