API keys

An API key lets an AI agent or a script work on your VillaSlot data without your password: list villas, find free slots, create customers and bookings. The Agents page explains how to connect an agent; the API reference lists every call.

Before you start: the right organization

A key belongs to one organization: the one currently selected in your team switcher when you create it. If you manage several organizations, switch to the one the agent should work on first.

Only owners and admins of that organization can create, see and delete its keys.

Create a key

API Keys in the Account section of the sidebar, then Create API Key.

1

Key Name

A name that says who uses it, such as Claude Code on my laptop or booking import script. It is the only way to tell keys apart later.

2

Expiration

Pick a date and time in Expires at, or tick Never expires. A date in the past is refused.

3

Create, then copy

Create shows Your new API key. Copy it now and store it somewhere safe — a password manager, or the environment variable your agent reads. Done closes the window.

This is the only time you see the key. The table afterwards shows only Key is hidden for security reasons. Lost it? Delete it and create a new one.

Leaving Expires at empty without ticking Never expires creates a key that never expires. Set a date if the access is meant to be temporary.

What the key can do

The key acts as the person who created it, in that organization: nothing more than they could do in the app, nothing less. If that person leaves the organization, the key stops working at once.

Not everything the app does is in the API — payments, refunds and overnight stays, among others, stay in the app. The Agents page lists what an agent can manage.

Revoke a key

The table lists each key's Name, Created date and Expires date. The delete button asks for confirmation in Delete API Key, then revokes the key immediately: every agent or script still using it is refused from that moment. This cannot be undone.

Revoke a key as soon as it is no longer used, or if it may have leaked — for example after pasting it into a shared prompt or committing it to a repository.