Authentication
Every call carries the API key we issue you:
curl https://api-booking-dev.gohubwallet.com.my/api/v1/agent/account \
-H "X-API-KEY: your-partner-key"
The key is the only source of identity
It resolves to your agent, and from there to your channel, your contracted pricing and your entitlements. You never send a channel, an agent id, or a price — anything you did send would be ignored.
This matters more than it sounds. A quote is minted for the channel your key resolved to, and booking resolves that channel the same way. There is no way to mint a quote you cannot then book, and no way to read another agent's order.
Rejections are specific
Nothing is defaulted or inferred, in any environment — there is no local bypass, so what you exercise against dev is exactly what runs in production.
| Condition | Status | Body |
|---|---|---|
No X-API-KEY header | 401 | {"reason":"missing-api-key"} |
| Key resolves to nothing active | 401 | {"reason":"invalid-api-key"} |
Key resolves, but your agent is not ACTIVE | 403 | {"reason":"agent-suspended"} |
Branch on reason, not on the message. "I sent nothing", "I sent something wrong" and "you are
suspended" are three different operational problems.
Which endpoints need a key
Everything except the two public autocompletes:
| Endpoint | Key |
|---|---|
GET /api/v1/airport-transfer/locations | not required |
GET /api/v1/express-bus/cities | not required |
| everything else | required |
Keeping the key safe
The key is a bearer credential: anyone holding it can book on your account and read your orders. Keep it server-side. Never ship it in a mobile app, a browser bundle, or anything a customer can open — a leaked key is spendable, and bookings made with it cannot be cancelled.