> ## Documentation Index
> Fetch the complete documentation index at: https://docs.unifystays.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Portal & Environments

> Configure suppliers, environment-specific credentials, and secure API access in the Unifystays portal.

Unifystays gives your team control of supplier activation and API keys from the
[Unifystays portal](https://unifystays.com). Your application integrates with
one API once; supplier setup happens in the portal for each environment.

## Configure an Environment

<Steps>
  <Step title="Sign in to the portal">
    Sign in to your Unifystays organization at
    [unifystays.com](https://unifystays.com).
  </Step>

  <Step title="Choose Sandbox or Production">
    Configure and test suppliers in **Sandbox** first. Use **Production** only
    for live search, booking, and cancellation traffic.
  </Step>

  <Step title="Enable a supplier">
    Select a supported hotel supplier, enter the credentials issued by that
    supplier, and enable it in the selected environment.
  </Step>

  <Step title="Create an API key">
    Create an API key for the same environment. You can manage and rotate keys
    in the portal without waiting for support.
  </Step>

  <Step title="Connect your backend">
    Send the API key in `x-api-key` with the matching base URL.
  </Step>
</Steps>

## Base URLs

| Environment | Base URL                             | Use it for                                               |
| ----------- | ------------------------------------ | -------------------------------------------------------- |
| Sandbox     | `https://api-sandbox.unifystays.com` | Development, integration testing, and launch validation. |
| Production  | `https://api.unifystays.com`         | Live customer traffic and supplier bookings.             |

<Warning>
  Sandbox and production keys are separate. A key must only be used with its
  matching environment base URL.
</Warning>

## Required Headers

| Header            | When to send it          | Purpose                                                                             |
| ----------------- | ------------------------ | ----------------------------------------------------------------------------------- |
| `x-api-key`       | Every request            | Authenticates your organization and selected environment.                           |
| `language`        | Recommended              | Requests localized content. Use `en` unless another supported language is required. |
| `Idempotency-Key` | `POST /hotels/book` only | Protects a booking attempt from duplicate reservations.                             |
| `X-Request-Id`    | Optional                 | Lets you provide your own trace ID; Unifystays returns one on every response.       |

```bash theme={null}
export UNIFYSTAYS_BASE_URL="https://api-sandbox.unifystays.com"
export UNIFYSTAYS_API_KEY="your_sandbox_api_key"

curl "$UNIFYSTAYS_BASE_URL/master-data/nationalities" \
  -H "x-api-key: $UNIFYSTAYS_API_KEY" \
  -H "language: en"
```

## Keep Credentials Safe

Call Unifystays from your trusted backend. Do not expose API keys in browser
code, mobile applications, public repositories, or client-side logs. When
rotating a key, deploy the replacement key first, confirm successful traffic,
then disable the old key in the portal.

## Add a Supplier Without Reintegrating

When you need a new supported supplier, enable it and add its credentials in
the portal. Your customer-facing integration remains unchanged: it continues
to use the same normalized Unifystays endpoints, response model, and booking
flow.

[Continue to the integration flow](/guides/hotel-booking-flow)