The Valpas API uses API key authentication. Include your API key in every request using the x-api-key header.
Each integration is issued its own key, so revoking one partner’s key never affects another’s.
Keys can also carry scopes. GIATA data requires the giata scope: without it, giata_id is returned as null and the /hotels/giata/* endpoints (and the giata_id filter) return HTTP 403.
Using your API key
Pass your key as an HTTP header named x-api-key:
Never expose your API key in client-side code or public repositories. Use environment variables to store secrets.
How to get an API key
Email team@valpas.io to request an API key. You will receive your key by email.
401 Unauthorized
If your request is missing an API key or the key is invalid, the API returns HTTP 401:
To resolve a 401:
- Verify your API key is included in the
x-api-key header (not a query parameter or body)
- Check that the key has not been revoked
- Confirm you are sending the request to
https://connect.valpashotels.com (not a staging URL)
