Sandbox first

Every partner gets a sandbox key the moment they're approved — a fully separate database, pre-seeded with demo providers and listings, so you can build against real responses before any business terms are final.

Idempotent by design

Every POST accepts an Idempotency-Key header. Retry a timed-out request safely — you'll get back the original response, not a duplicate order.

Signed webhooks

Order and payment events are pushed to your endpoint with an HMAC-SHA256 signature, so you never have to poll — and can verify every payload came from us.