> ## Documentation Index
> Fetch the complete documentation index at: https://docs.seyaha.net/llms.txt
> Use this file to discover all available pages before exploring further.

# Developer Settings

> Obtain your API credentials and configure your affiliate integration.

Navigate to **Settings → Developer** to access credentials and configuration options
for the [Affiliate API](/pages/affiliate/quickstart). This section is intended for
developers building custom booking experiences — not needed if you only use affiliate links.

## Authentication overview

The Affiliate API uses **JWT (JSON Web Token)** authentication. JWTs are tied to a
user session and carry identity and permission claims.

```http theme={null}
Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...
```

Unlike a static API token, JWTs have a limited lifetime. For production integrations,
users authenticate via OAuth and receive a fresh JWT per session. For development,
you can generate a long-lived test token below.

## Development test token

For testing and building your integration before setting up production auth:

1. Go to **Settings → Developer**
2. Click **Generate test token**
3. Copy the JWT — it is valid for **90 days**
4. Use it in API calls: `Authorization: Bearer <token>`

<Warning>
  Test tokens have full access to your affiliate account including creating bookings
  and processing payments. Never embed them in client-side code or commit them to
  version control. Regenerate your test token if you suspect it has been exposed.
</Warning>

To revoke a test token before it expires, click **Revoke token** next to it in
the Developer Settings page. You can generate a new one at any time.

## Production authentication flow

For a live integration where your end users log in:

1. Register your redirect URI with Seyaha — go to **Developer → OAuth settings** and
   click **Add redirect URI**
2. Direct users to the Seyaha login URL provided in Developer Settings
3. After login, Seyaha redirects to your URI with a short-lived authorization code
4. Exchange the code for a JWT by calling the token endpoint
5. Use the JWT in `Authorization: Bearer` headers — default TTL is **1 hour**
6. Refresh before expiry using the refresh token returned alongside the JWT

Contact `tech@seyaha.net` to request OAuth setup for your account.

## API base URL

```
https://api.seyaha.net/api/v1/affiliates
```

User-scoped endpoints are under:

```
https://api.seyaha.net/api/v1/affiliates/users
```

Store these alongside your credentials in your environment configuration.

## Your affiliate ID

Your affiliate account identifier is shown at the top of the Developer Settings page.
Include it when contacting support so we can locate your account quickly.

When creating bookings via the API, the JWT automatically associates the booking with
your affiliate account — you do not need to pass your affiliate ID as a parameter.

## Webhook configuration

Receive real-time events for bookings attributed to your account:

1. Click **Add webhook endpoint**
2. Enter your publicly accessible HTTPS endpoint URL
3. Select the events to receive:
   | Event                  | Fired when                                        |
   | ---------------------- | ------------------------------------------------- |
   | `booking.created`      | A new booking is attributed to your account       |
   | `booking.confirmed`    | A booking's status moves to Confirmed             |
   | `booking.cancelled`    | A booking is cancelled                            |
   | `payment.completed`    | A payment is successfully processed               |
   | `commission.confirmed` | A commission is locked in after the activity date |
4. Click **Save endpoint**

Seyaha sends a `POST` request with a JSON body and a `x-seyaha-signature` header
for verification. See [Webhooks](/pages/partner/webhooks) for the HMAC signature
verification algorithm (same scheme used across all Seyaha webhook types).

### Testing your webhook

Click **Send test event** next to any saved endpoint to receive a sample payload.
The test event is marked with `"test": true` in the payload so your handler can
ignore it in production.

## Testing your integration

Use the **Test connection** button to verify your JWT is valid:

```bash theme={null}
curl "https://api.seyaha.net/api/v1/affiliates/users/activities?currency=SAR&pageSize=1" \
  -H "Authorization: Bearer $AFFILIATE_JWT"
```

A `200 OK` with a `data` array confirms your token is active.

## Next steps

* [Affiliate API Quickstart](/pages/affiliate/quickstart) — make your first API call
* [Activities API](/pages/affiliate/activities) — list and filter the catalog
* [Bookings API](/pages/affiliate/bookings) — create bookings and process payments