Access & API keys

Before your first call, your Brave Booking contact provides a partner credentials pack. This page describes what you receive and how to use it.

Environments

Each partner has two independent environments:

What you receive

• X-Api-Key — your public key (e.g. VOTRE_CLE_API), sent with every Brave gateway request.
• The secret — shown only once at creation. It is only used to compute the signature; it is never sent in requests. Brave only stores its hash.
• Allowed IPs — the list of egress addresses allowed to call the gateway. A request from any other IP is rejected (403).
• Enabled gateways and formats — Brave, OS-Travel and/or Cyberesa, in JSON and/or XML. Only enabled gateways respond.
• Quotas — per-second and per-day call quotas for your key. See Rate limits.

The company code

The Brave gateway URL contains the company code of the Brave company whose stock you sell:

# code = 1000 (demo company)
https://partners.bravebooking.net/v1/1000/ping

You may distribute stock from several Brave companies: just change {code} in the URL, with the same key if it is authorized for those companies.

Compatible gateways

The OS-Travel and Cyberesa gateways use their own credentials, provided with your Brave key:

• OS-Travel — Login and Password sent in every request (Credential). See OS-Travel (Octasoft).
• Cyberesa — Login and Password in the XML (<Credential>), plus your numeric agency id (<User>). See Cyberesa.

Best practices

• Store the secret in a secrets manager, never in code or a repository.
• Never share a key between two partners: one key = one partner, traceable in the call log.
• Plan for rotation: a key can be rotated or revoked at any time by the Brave company.