# Quickstart

Issue a secret key, make one authenticated request, then wire bookings or webhooks. Staging and production are separate deployments with separate keys.

1. **Create a key.** In the company dashboard, open Developers → API keys. Name the key after the system that will use it (for example “Production CRM”). Leave scopes empty for full access, or pick only what that system needs.
2. **Store the secret once.** The full secret (sk_live_…) is shown a single time. Safra stores a hash, not the plaintext. Put it in your secret manager. If you lose it, revoke and create a new key.
3. **Call the company endpoint.** Send the secret as a Bearer token over HTTPS. The company is implied by the key — you never pass a company id in the path.

## First request

**curl**

```
curl -sS -H "Authorization: Bearer sk_live_…" \
  https://safraway.com/api/partner/v1/company
```

**Node**

```
const res = await fetch("https://safraway.com/api/partner/v1/company", {
  headers: { Authorization: `Bearer ${process.env.SAFRA_KEY}` },
});
if (!res.ok) throw new Error(await res.text());
console.log(await res.json());
```

**PHP**

```
$ch = curl_init('https://safraway.com/api/partner/v1/company');
curl_setopt_array($ch, [
    CURLOPT_HTTPHEADER => ['Authorization: Bearer '.getenv('SAFRA_KEY')],
    CURLOPT_RETURNTRANSFER => true,
]);
echo curl_exec($ch);
```

> **Dashboard:** Keys, webhook endpoints, and request logs live at https://safraway.com/company/developers. Only company owners and admins can open Developers.

## What to do next

- Create a booking from a passenger phone if you run a call centre or CRM.
- Subscribe to webhooks instead of polling for status changes.
- Restrict scopes on keys that only need bookings.read.
- Send Idempotency-Key on every write your system might retry.