Authentication

The Partner API uses a two-step token-based authentication flow.

1) Partner API key (refresh token)

The Partner API key generated on your WeTravel profile page acts as a refresh token.

• It cannot be used to perform API requests directly.
• It must be exchanged for a short-lived access token.
• Do not share this key or expose it in client-side code or public repositories.

2) Issue an access token

To make API requests, you must first issue an access token using the following endpoint:

👉 Issue access token

The request must include your Partner API key in the Authorization header using the Bearer scheme.

If successful, the endpoint returns an access token that:

• is valid for 1 hour
• must be sent in the Authorization header using the Bearer scheme for all subsequent API requests

3) Using the access token

Use the issued access token to authenticate all Partner API requests until it expires.

When the access token expires, request a new one using the same Partner API key.

Important security notes

• Never commit your Partner API key to GitHub or other version control systems.
• Store credentials securely (e.g. environment variables or a secrets manager).
• If you believe a key has been compromised, rotate it from your WeTravel profile and
  update all affected services promptly.

Partner API key generation and regeneration

A Partner API key is generated from your WeTravel account under
Partner API Integration.

Key generation behavior

• The Partner API key is displayed only once at creation time.
• You must copy and securely store the key immediately.
• After a page refresh, the key is no longer visible.
• Only a Revoke API key option is available after generation.

Regenerating a Partner API key

To generate a new Partner API key, you must first revoke the existing one.

⚠️ Important: Revoking a Partner API key immediately deprecates it.

• Once revoked, the key can no longer be used to issue access tokens.
• API clients must be updated to use the newly generated key.
• Requests that attempt to issue access tokens with a revoked key will fail.

Operational guidance

Because only one Partner API key can be active at a time:

• Plan key regeneration carefully to avoid service disruption.
• Update all environments and services promptly after generating a new key.
• Verify access token issuance succeeds with the new key before resuming normal operations.