Travel API Integration: A Practical Guide for Agencies

A travel API integration connects your booking website to a supplier's live inventory, so a customer can search, see a real price and book without anyone copying rates by hand. Getting one live takes more than writing code. You need an approved supplier account, test credentials, a booking flow that handles price changes and cancellations correctly, a certification review by the supplier, and production keys that often only work from your server's IP address.

This guide walks through those steps in the order they happen, with notes on the hotel and flight suppliers agencies ask us about most. Supplier details come from their own documentation, read in November 2026.

Step 1: Get a commercial agreement first

Most suppliers will not issue live API keys until your agency has an approved account and a signed agreement. WebBeds says API access follows a commercial agreement and a technical approval. RateHawk's API documentation says a relevant agreement must be signed before you use the API. Hotelbeds is the exception at the start: its developer portal gives a free evaluation key so you can build and test before you talk to sales, limited to 50 requests a day.

Apply for the account early, because approval is usually the slowest part. If you have not opened supplier accounts yet, our guide to opening hotel supplier accounts as a new agency covers what they ask for.

Step 2: Build against the test environment

Every serious supplier has a sandbox or test key. Use it to build the full flow, from search to cancellation. A hotel booking flow usually has five parts:

1. Search: availability and prices for a city or a list of hotels, dates and guests.
2. Rate check: confirm the price and conditions of the exact room the customer picked.
3. Book: create the reservation with the guest names.
4. Retrieve: read the booking back to confirm its status.
5. Cancel: cancel and read the penalty, if any.

The rate check is the step teams most often skip, and it is the one that saves you money. Search results are cached and can be minutes old. Hotelbeds, for example, marks some rates as needing a recheck and expects a CheckRate call before booking them. Flight APIs work the same way: Duffel's guides recommend getting an accurate price again before payment.

Step 3: Map the static content

Prices come from the live API, but hotel names, photos, addresses, star ratings and room descriptions usually come from a separate content feed that you download and refresh. RateHawk's integration rules, for example, cover syncing this static content. If you sell from more than one supplier, the same hotel will appear under different IDs, and deciding when two records are the same hotel is real work. Get it wrong and customers see the same hotel twice with two prices, or two different hotels merged into one.

Step 4: Handle the details that cause disputes

Certification reviews focus on the parts of a booking that end up in customer complaints. Expect to be checked on these:

• Cancellation policies shown exactly as the supplier returns them, with deadlines in the right time zone.
• Taxes and fees that are paid at the hotel shown separately from the price paid online.
• The guest's nationality or residency sent correctly, because it can change the rate.
• Room and guest limits respected, including child ages.
• Booking status read back after booking, instead of assuming success when the request times out.

That last one matters more than it looks. If a booking request times out and your code simply tries again, you can create two bookings for one customer. A safer pattern is to check the booking status with your own reference before retrying.

Step 5: Pass certification

Certification is the supplier reviewing your integration before it sends you production keys. RateHawk's documentation puts the process at about 14 to 30 days and certifies each product separately. Hotelbeds lists certification as the step between building on the evaluation key and going live. You usually run a set of test bookings and send screenshots of your search, booking and voucher pages.

When we certified our own RateHawk connection, the review covered a set of sandbox booking scenarios, and the questions were about what the customer sees: the cancellation wording, the price breakdown and the voucher.

Step 6: Go live, and whitelist your server IP

Production keys often work only from IP addresses you register with the supplier. That means two things in practice. Give the supplier your server's fixed IP before go-live, and remember to update it every time you move servers. A shared hosting plan whose outgoing IP can change is a poor fit for this. On our own platform, supplier IP whitelisting is the step that decides how quickly we can move to a new server, because each supplier has to update its list.

Step 7: Monitor after launch

Suppliers change things. They retire endpoints, add required fields and adjust timeouts. Set alerts for failed bookings and for searches that suddenly return nothing, and read every API change notice the supplier sends. A booking flow that silently fails costs more than one that fails loudly.

Supplier notes

Supplier	Type	How access starts	Worth knowing
RateHawk	Hotels, REST API	Agreement first, then sandbox keys from your account manager	Certification about 14 to 30 days; B2B net prices with your own markup
Hotelbeds	Hotels, transfers, activities	Free evaluation key from the developer portal, 50 requests a day	Some rates need a CheckRate call before booking
WebBeds	Hotels and ground services	After a commercial agreement and technical approval	Rates can be net or commissionable depending on your agreement
Duffel	Flights	Test tokens on sign-up	Published per-order pricing; re-price before payment
PKFARE	Flights	A buyer account, then a Partner ID and key from your business manager	GDS, low cost and NDC content in one API

For each supplier's sign-up and login steps, see our guides to RateHawk, Hotelbeds and WebBeds, and the flight API comparison.

Build it yourself or use a platform?

Building your own integration makes sense when you have developers, a supplier mix nobody else supports, or volume large enough to justify the work. Expect each supplier to take weeks, and plan for ongoing maintenance as their APIs change.

A booking platform that already holds certified connections changes the job. You still open your own supplier accounts, but you connect your keys in a dashboard instead of building and certifying a booking flow. On Travora Hub, agencies sell hotels live today from RateHawk, WebBeds, Hotelbeds and Billbed, and flights from Duffel and PKFARE, each on the agency's own account. The full list is on the integrations page. There is no GDS connection today, so agencies that need Amadeus, Sabre or Travelport would have to integrate those separately.

Frequently asked questions

How long does a travel API integration take?

For one hotel supplier, plan on several weeks of development plus the supplier's certification time, which RateHawk puts at about 14 to 30 days. Account approval comes before all of that.

Do I need to be IATA accredited to use a flight API?

Not always. Some flight APIs, such as Duffel's Managed Content, let you sell under the provider's accreditation for a fee. Ticketing under your own accreditation means applying to IATA.

What is the difference between XML and JSON travel APIs?

They are two formats for the same messages. Older supplier APIs often use XML or SOAP, and newer ones use JSON over REST. The booking steps are the same either way.

Can I connect more than one hotel supplier?

Yes, and many agencies do, because the price for the same hotel and date can differ between suppliers. Plan for the hotel mapping work in step 3.

To see a certified integration from the customer's side, run a search in the live demo and follow a booking through to the voucher.