Authentication & Headers

Every API request must include the following headers:

Content-Type: application/json
Coras-Distributor: <your-distributor-id>

For transactional endpoints (reservations, attractions search, etc.), you also need:

Booking-Session: <booking-session-token>

For most requests, no API key or OAuth flow is required — authentication is based on your Distributor ID and booking session token.

However some requests, for example certain requests related to payments and transactions, do require authentication by means of an authorization token. A token can be obtained by submitting a login and password (supplied by your Coras account manager) to the /auth endpoint.

The token returned can then be used in subsequent requests by including it in the Authorization header, using the Bearer authentication scheme:

Authorization: Bearer <token>