An API key lets your own tools read your Samba data: sync bookings and customers into a CRM or spreadsheet, send payments and invoices to your accounting tool, or show your trips and seats left on your own website. Keys are read-only, so nothing connected with one can change a booking.
Before you start
Only Owners and Admins can create and revoke keys.
Have the integration's settings open, so you can paste the key straight in: it is shown only once.
Create the key
Go to Settings → API keys.
Click Create key.
Give it a Name that says what will use it, such as "HubSpot sync", so you know which key to revoke later.
Click Create key.
Click Copy key and paste it into your integration's secret settings.
Click Done.
This is the only time the full key is shown. Once you close the dialog, Samba only shows its last four characters. If you lose it, create a new key and revoke the old one.
What happens next
The key appears in the list with its name, who created it, and when it was last used.
Your integration sends it with every request as
Authorization: Bearer <key>. The endpoints, filters and examples are in the API docs, also available from Help → API docs in the panel.To stop an integration, click Revoke next to its key. Anything using that key stops working immediately, and this cannot be undone.
What can someone do with my key?
What can someone do with my key?
Read everything in your workspace: trips, dates, bookings, participants and customers (including their contact details), payments and refunds, invoices and credit notes, booking and cancellation requests, discount codes, and your travelers' task answers and uploaded files. Task answers can include passport and health details. It cannot create, change or cancel anything. Treat it like a password: keep it in your integration's secret settings, never in a web page or an email.
Do keys expire?
Do keys expire?
No. A key works until you revoke it, and it keeps working if the person who created it leaves your team.
How many requests can my integration make?
How many requests can my integration make?
120 per minute per key. Above that, requests are refused until the minute passes. Give each integration its own key so one cannot slow the others down.