Skip to main content

Hotel-X Credentials

API Key​

An API key is a unique alphanumeric code used for authentication when accessing the Hotel-X API. It must be included in the HTTP Authorization request header to verify and authenticate the user agent with the server. This secure identifier ensures that only authorized users can access API functionalities.

How to Find and Manage Your API Keys:​

  1. Log in to the Travelgate App.
  2. Click on Manage > API Keys in the menu that appears when you click on your user icon in the top right corner.
  3. Navigate to API Settings to view a list of API keys associated with your organization (encrypted).
  4. To create a new API key, click Create New API Key and complete the required form. Copy the API key immediately, as this is the only time it will be fully displayed.
    • Important: Generated API keys cannot be retrieved later. If lost, a new one must be created. Previously used API keys will remain active.
info

Your API key remains the same across both test and production environments.

Access​

An access is a combination of authentication details and configurations that enable a Buyer to connect with a Seller. It helps differentiate Sellers and manage multiple credentials or configurations from the same Seller (e.g., B2B vs. B2C feeds). You can review access details in My Connections.

info
  • Each Seller may have different access credential requirements depending on their system specifications. Some may require only basic fields, while others require additional data or specific URL endpoints for methods such as Search, Quote, or Book. Supplier authorization may rely on a username and password or a Supplier-generated API key (not to be confused with the Travelgate API Key used to authenticate Travelgate users).
  • All access details must be provided and confirmed by each Seller.

To facilitate testing, these accesses have been pre-activated for your account.

How to Obtain an Access Code from an Actual Seller​

To obtain an access code from a Seller, you must establish a commercial agreement with the desired Partner and request activation via the Auto-Activations Form.

important
  • Avoid making live bookings during the Hotel-X implementation process until Travelgate has certified your development. If you create test bookings, ensure they are canceled and refundable.
  • To ensure proper billing, all cancellations must be handled via the API. If you encounter any issues, contact Customer Support for assistance.

Client​

A client is an entity purchasing accommodation services through the Hotel-X API. Client codes remain consistent across all Travelgate implementations and help identify the requesting business and its assigned configurations.

Multiple client codes may be used to distinguish different traffic types, such as B2B and B2C transactions (e.g., client_b2b, client_b2c). Since all accesses are compatible with any client code, selecting the appropriate one is essential. You can review client information in your API Settings.

Context​

A context represents the content codes used by Buyers and Sellers. Each Seller has a unique context, which may differ between test and production environments. Context codes include specific hotel, board, and room codes. This information is available in My Connections.

Buyers can either use their own context or select content providers. Buyer context codes are generated by the Buyer (not provided by Travelgate) and are used in mapping file names to align Supplier codes with the Buyer's mapped codes. For more information, see the Mapping Plugin.

What is the Difference Between Access and Context?
  • Access contains your authentication credentials for a specific connection.
  • Context is the internal Travelgate code required to request Supplier codes or mapped Buyer codes (uploaded to our SFTP).

For more details, refer to the HotelX Buyers API Documentation and API Settings.

What is the difference in credential management between Legacy and Hotel-X?​

Besides using different technologies (XML vs GraphQL) and offering different levels of functionality, the main difference between Legacy API (deprecated) and Hotel-X API lies in how supplier credentials are selected, stored, and used in requests.

In the Legacy API, the Buyer must explicitly send the supplier configuration in every request:

  • Username
  • Password
  • Additional supplier parameters

These credentials were included directly in the XML request. The Buyer was fully responsible for managing, storing, and updating them.

In Hotel-X, supplier credentials are not sent in the API request. Instead:

  • The Buyer sends an access code in the request.
  • This access code references a supplier configuration (username, password, parameters) securely stored in the Travelgate platform.
  • Supplier credentials are managed through the My Connections section of the website.
  • Authentication is performed using the Travelgate API Key, sent in the request headers.
What role does the API Key play?
  • Is used only to authenticate the Buyer to Travelgate.
  • Is sent in the request headers.
  • Is not supplier-specific.
  • Is not validated by the supplier.
  • Is not stored in the access configuration.
Do both Legacy and Hotel-X APIs use supplier credentials?

Yes. Both APIs rely on supplier credentials, but they differ in how those credentials are referenced:

  • Legacy (deprecated): Credentials are sent explicitly in every request.
  • Hotel-X: Credentials are referenced indirectly via an access code. This makes Hotel-X more secure, easier to maintain, and better suited for complex integrations.
Do I need to create new accesses when migrating from Legacy?

Not necessarily. If you are already using the Legacy API and your supplier credentials already appear in My Connections with an associated access code, you do not need to create new accesses. You can reuse the same access codes when working with Hotel-X.

Who manages supplier credentials in Hotel-X?

Supplier credentials are managed through the Travelgate platform:

  • The Buyer uses the access code in Hotel-X API requests.
  • The Seller and Buyer can manage credentials and configuration via My Connections.

Credentials are no longer managed inside the API request itself. Centralizing credential management in Travelgate:

  • Reduces operational complexity
  • Improves security
  • Avoids credential duplication
  • Simplifies supplier and access management
  • Makes migration and maintenance easier