Quickstart

Issue a secret key, make one authenticated request, then wire bookings or webhooks. Staging and production are separate deployments with separate keys.

Create a key. In the company dashboard, open Developers → API keys. Name the key after the system that will use it (for example “Production CRM”). Leave scopes empty for full access, or pick only what that system needs.
Store the secret once. The full secret (sk_live_…) is shown a single time. Safra stores a hash, not the plaintext. Put it in your secret manager. If you lose it, revoke and create a new key.
Call the company endpoint. Send the secret as a Bearer token over HTTPS. The company is implied by the key — you never pass a company id in the path.

First request

curl

curl -sS -H "Authorization: Bearer sk_live_…" \
  https://safraway.com/api/partner/v1/company

Node

const res = await fetch("https://safraway.com/api/partner/v1/company", {
  headers: { Authorization: `Bearer ${process.env.SAFRA_KEY}` },
});
if (!res.ok) throw new Error(await res.text());
console.log(await res.json());

PHP

$ch = curl_init('https://safraway.com/api/partner/v1/company');
curl_setopt_array($ch, [
    CURLOPT_HTTPHEADER => ['Authorization: Bearer '.getenv('SAFRA_KEY')],
    CURLOPT_RETURNTRANSFER => true,
]);
echo curl_exec($ch);

What to do next

Create a booking from a passenger phone if you run a call centre or CRM.
Subscribe to webhooks instead of polling for status changes.
Restrict scopes on keys that only need bookings.read.
Send Idempotency-Key on every write your system might retry.