Getting your API keys

Your website or booking widget needs one or two keys to talk to your booking system. An account admin can issue these directly from your dashboard’s Add to your website screen — no need to ask us for a routine key.

Issue a key yourself

1. Open Add to your website in your dashboard.
2. Click Issue key, give it a name (so you can tell it apart later — for example “Website integration”), and pick the kind (below).
3. For a publishable key, add the website address(es) it’s allowed to run on, one per line. To allow every subdomain of one site, write https://*.example.com. That does not include https://example.com itself, so add it as a separate line.
4. For a secret key, tick what it may do. You can also list the IP addresses of your website’s server, one per line. Then the key works only from those addresses. This is optional, and we advise it. With no list, the key works from any address.
5. Copy the key immediately and save it somewhere safe: a password manager, not a chat message or a note you might lose.

Shown once

The key is shown to you exactly once. If you navigate away without copying it, the only fix is issuing a new one.

Only an account admin can issue or revoke keys. If you don’t see this screen, ask whoever set up your account to add you as an admin, or to issue the key for you.

The two kinds

• A secret key. Goes only on your website’s own server — hand it to your developer or agency, never anywhere public. It can do everything we’ve allowed for your account: read guest details, create and cancel bookings, change your rates.
• A publishable key. Safe to be visible on your website — it’s what our booking widget uses, and what the read-only calendar box uses too. It can check availability, get a price, start a hold, and take a guest to a secure Stripe payment page. It can’t read a guest’s name or email, and it can’t move money on its own, even if someone finds it by viewing your page’s source code.

If you’re not sure which one your developer is asking for, see Secret keys vs. publishable keys.

Change the website or IP list later

You do not need a new key to change where a key may be used. On the Add to your website screen, click Edit restrictions next to the key. Add or remove websites (publishable key) or IP addresses (secret key). The change works on the very next request, and your website keeps working.

Test keys vs. live keys

A test key lets you and your developer try the whole booking flow safely, without touching real guest bookings or real money. A live key is for real guests.

The Issue key screen makes live keys only. If your developer needs a test key to build with, ask us. We make test keys for you, and we hand them over the same way. Once everything works, use the live key you made on the screen. Nothing about how your website talks to the API changes, only the key itself.

If you lose a key

We never see the full value again after it’s issued, so we can’t recover a lost key for you. Issue a new one and update it wherever the old one was used — see If a key leaks for the same steps, which apply whether the key leaked or you simply misplaced it.

Next steps

• Secret keys vs. publishable keys — which kind to hand your developer.
• If a key leaks — what to do next.