# Migrating from the legacy endpoint

Three older ways of connecting are being retired. The ?key= endpoint and employee tokens were switched off on 11 October 2026, and older widget keys were switched off on 20 October 2026. Everything they did has a current replacement, and most migrations take a few minutes.

> **The ?key= endpoint and employee tokens were switched off on 11 October 2026, and older widget keys were switched off on 20 October 2026.** Until then the older connections still work and their responses carry a `Sunset` header. From those dates they answer with HTTP 410 and the error code `legacy_key_retired`. Move to a current key rather than waiting.

## What is going away

| If you use… | Replace it with… |
| --- | --- |
| The open-data endpoint `GET /api/resources` with `?key=` or an `X-API-Key` header | `GET /dash/api/v1/resources` with a developer key (`bapi_pk_…`) in the `Authorization` header. |
| An employee token on `/dash/api/resources` | A team key (`bapi_tk_…`) with the directory management permission. |
| A widget key in your embed snippet | A browser key (`bapi_pk_…`) made from your Space, or a team key (`bapi_tk_…`) with the `embed:widget` scope, in `data-key`. |

## Open-data reads

1. Open [/dash/developers/keys](https://bynefit.com/dash/developers/keys) and create a developer key. Keys you already hold were carried over and work as bearer tokens; if one is rejected, create a new one.
2. Change the URL from `/api/resources` to `/dash/api/v1/resources`.
3. Move the key out of the query string and into the header: `Authorization: Bearer bapi_pk_…`.
4. Switch paging from `offset` to `cursor`, and read results from `data` instead of `resources`. The full shape is on [Resources — read](https://bynefit.com/docs/resources-read).

**Before (switched off on 11 October 2026)**

```
curl "https://bynefit.com/api/resources?key=YOUR_KEY&category=food"
```

**After (current)**

```
curl "https://bynefit.com/dash/api/v1/resources?category=food" \
  -H "Authorization: Bearer bapi_pk_…"
```

### What changes, field by field

Nothing is removed from an entry. The new endpoint returns every field the old one did, and adds a few. Anything you send that the new endpoint does not know is ignored.

| Old `/api/resources` | New `/dash/api/v1/resources` | Notes |
| --- | --- | --- |
| `?key=` or `X-API-Key` | `Authorization: Bearer bapi_pk_…` | A legacy key in the query string is refused from 20 October 2026. A `bapi_` browser key in the query string keeps working. |
| `category` | `category` | Same twelve values. |
| `limit` (up to 500, default 100) | `limit` (up to 200, default 50) | Ask for more pages instead of a bigger page. |
| `offset` | `offset`, or `cursor` | `offset` still works. `cursor` is steadier while entries are being added. Use one or the other. |
| Most upvoted first | `sort=popular` | The default is now newest first. Add `sort=popular` for the old order. It pages with `offset`. |
| Not available | `since` | Only entries added on or after an ISO-8601 time. |
| `data` | `data` | Same. |
| `count`, `total`, `has_more` | `count`, `total`, `has_more` | Same meaning, except `total` reads `"10000+"` above 10,000 and is left out when you use `offset`. Use `has_more` to stop paging. `next_cursor` is new. |
| `byn_id` | `byn_id`, and `id` as `res_` plus the same value | Either identifies the entry. |
| `registered_on`, `go_website`, `go_phone`, `upvote_count` | Same names | Same values. |
| `name`, `description`, `category`, `address`, `phone`, `website`, `hours` | Same names | Same values. |
| Not available | `type` | Always `resource`. |
| `meta.description` | Not returned | The rest of `meta` is the same. |
| Errors as text | Errors as a short `error` code | Codes are listed on [Resources — read](https://bynefit.com/docs/resources-read). |
| No call limit | A limit per key per hour, in `X-RateLimit-Limit` | Read `X-RateLimit-Remaining` and wait for `Retry-After` on a `429`. |

Calling from a web page works too: the endpoint answers the browser's preflight check for the `Authorization` header from any website.

One transition allowance: a legacy key still works in the `?key=` address on `GET /dash/api/v1/resources`, and only there, so that embedded directory pages keep loading. It is read-only, limited to the public directory and to the public rate limit. It was switched off on 20 October 2026; after that, send the key as `Authorization: Bearer`.

## Directory management

Create a team key at [/dash/integrations/api-tokens](https://bynefit.com/dash/integrations/api-tokens) and send it as `Authorization: Bearer bapi_tk_…` to the same `/dash/api/resources` endpoints described on [Resources — manage](https://bynefit.com/docs/resources-write). The directory management permission is approved for one Space at a time: an admin of the Space chooses **Request access** next to *Manage your directory* on that page, and Bynefit emails the answer, usually within one business day. Once it is approved, tick it when you make the team key.

## Embed widget

The quickest way is the Embeds page: open [/dash/integrations/embeds](https://bynefit.com/dash/integrations/embeds) and choose **Copy the new snippet** under "Copy the new snippet for your embed". It makes a browser key and shows the whole snippet once. Paste it where the old snippet was. Your allowed sites carry over, and the old key keeps working until 20 October 2026.

**Before (switched off on 20 October 2026)**

```
<script src="https://bynefit.com/widget.v2.js" data-key="wk_…"></script>
```

**After (current)**

```
<script src="https://bynefit.com/widget.v2.js" data-key="bapi_pk_…"></script>
```

You can also make the key yourself: on [/dash/integrations/api-tokens](https://bynefit.com/dash/integrations/api-tokens) choose **Create key** and **Run in a visitor's browser** to make a browser key, which is safe in a page and follows the allowed sites on your Embeds page. Or create a team key with `embed:widget` (see [Embed widget](https://bynefit.com/docs/widget)), then put it in the `data-key` attribute of your script tag in place of the old widget key. Redeploy the page now: an embed still using the old key gets a 410 error.

## Resource directory widget

The `resources-widget.js` directory script sends your key in the `Authorization` header to `/dash/api/v1/resources`. Put a developer key (`bapi_pk_…`) from [/dash/developers/keys](https://bynefit.com/dash/developers/keys) in its `data-key`. List your website on the key so other sites cannot use it. A key you already held for the old address keeps working as `data-key`; if it is refused, make a new one. The directory allows 60 calls an hour per key.

**After (current)**

```
<div id="bynefit-resources"></div>
<script src="https://bynefit.com/resources-widget.js" data-key="bapi_pk_…"></script>
```

## Check you are done

- Your responses no longer carry a `Sunset` header.
- No page or server on your side still contains `?key=`, `X-API-Key`, or an old widget key.

---

Source: https://bynefit.com/docs/legacy-sunset
Checked against the live API on October 10, 2026.