Skip to main content
The Valpas API uses API key authentication. Include your API key in every request using the x-api-key header. Each integration is issued its own key, so revoking one partner’s key never affects another’s. Keys can also carry scopes. GIATA data requires the giata scope: without it, giata_id is returned as null and the /hotels/giata/* endpoints (and the giata_id filter) return HTTP 403.

​
Using your API key

Pass your key as an HTTP header named x-api-key:
Never expose your API key in client-side code or public repositories. Use environment variables to store secrets.

​
How to get an API key

Email team@valpas.io to request an API key. You will receive your key by email.

​
401 Unauthorized

If your request is missing an API key or the key is invalid, the API returns HTTP 401:
To resolve a 401:
  • Verify your API key is included in the x-api-key header (not a query parameter or body)
  • Check that the key has not been revoked
  • Confirm you are sending the request to https://connect.valpashotels.com (not a staging URL)