Cancel Hansel Authentication

API Key lifecycle

Partners request API keys for server-side integration, rotate keys periodically, and revoke keys when they are no longer required. Each key should be stored securely, managed by operations teams, and scoped to the integration purpose.

Server-side key storage

Store API keys in secure vaults or configuration stores and never embed them in browser code, mobile apps, or client-side scripts. Treat API keys as confidential credentials for system-to-system access.

Authentication examples

curl -X GET https://api.cancelhansel.com/v1/health \
  -H "x-api-key: YOUR_API_KEY"

Valid authenticated request example:

GET /v1/bookings/booking_789/webhook-events HTTP/1.1
Host: api.cancelhansel.com
x-api-key: YOUR_API_KEY

Example failed auth response:

401 {
  "error": "Unauthorized",
  "message": "Missing or invalid x-api-key"
}

Webhook signature verification

Cancel Hansel signs webhooks with x-cancel-hansel-signature. Partners should verify this signature before trusting payload contents, and should reject events when signature validation fails.

This practice helps preserve evidence integrity and reduces risk when processing booking lifecycle events.

Integration guidance

API keys are used for partner requests. Webhook signatures are used for inbound event verification. Both safeguards are essential for reliable evidence infrastructure and operational accountability.