How to get an API token and set up webhooks

The company token gives external programs access to branch data through the RentProg API. Webhooks work in the opposite direction: RentProg itself tells your program that a booking, client or vehicle has been created, changed or deleted.

Both settings are in the company profile, on the “Integrations” tab, in the “Token for API access and booking form” and Webhooks panels.

Who has access

What	Condition
The “Token for API access and booking form” panel	API access: the API service is in the plan and access has not been disabled by RentProg administration
Copy and refresh the token	Manager and above; the field is not shown to partners and guests
The Webhooks panel	API access, separately enabled webhook access, and the webhook service in the plan
Add, change and delete webhook URLs	Company employees
See the webhook signing secret	Company employees; not shown to partners and guests

How to copy the token

1. Open the company profile, the “Integrations” tab, the “Token for API access and booking form” panel.
2. Click the “API Token” field or the copy icon in it — the token is copied to the clipboard.

Each branch has its own token. The same token is needed by external services, for example the booking form on your website.

How to refresh the token

1. Click “Refresh Token” in the “Token for API access and booking form” panel.
2. Confirm the refresh.
3. Copy the new token and replace it in all external services.

Important

When the token is refreshed, all external services using the old token will stop working. The old token cannot be restored.

How a program signs in to the API

The program exchanges the company token for a temporary access key and then sends it in the Authorization header of every request:

GET /api/v1/public/get_token?company_token=<company token>

The temporary key is valid for 4 hours. Rate limits: reads — 120 requests per minute per company, writes — 60 requests per minute.

Important

If API access is disabled, the server refuses and asks you to contact support. If the company's subscription is suspended for non-payment, the API also refuses until the company balance is topped up.

How to add a webhook URL

1. Expand the Webhooks panel and click “Add webhook URL”.
2. Enter your program's address in the “Webhook URL” field.
3. Select events in the “Event subscriptions” field — at least one.
4. Turn on “Only created via API” or “Only updated via API” if you only need records that came in through the API.
5. Click the save icon with the tooltip “Save webhook URL”.

The URL will not be saved without an address or without events. The address is checked for format.

Events you can subscribe to: “Booking created”, “Booking updated”, “Booking deleted”, “Client created”, “Client updated”, “Client deleted”, as well as vehicle creation, change and deletion.

A URL belongs to the branch in which it was created: events arrive for that branch's records.

How to verify a delivery signature

After saving, the URL gets a signing secret field. The secret is generated once when the URL is created and does not change when you edit it. Copy it with the copy icon and store it on your program's side.

Each delivery is a POST request with a JSON body:

{"event": "booking_create", "payload": "<record data as a JSON string>"}

Delivery headers:

Header	What it contains
X-Webhook-Signature	sha256= and the request body signature using the HMAC-SHA256 algorithm with the URL's secret
X-Webhook-Event-Id	Event ID
Idempotency-Key	The same event ID — identical for all retries and resends

The signature is computed over the exact bytes of the request body. RentProg does not send unsigned deliveries.

When a delivery is considered failed

Your program's response	What RentProg does
200, 201 or 204	The delivery succeeded
408, 429, a dropped connection or no response within 10 seconds	Retries the delivery with an increasing pause, up to 8 attempts in total; after the last one — an error
404	Records an error and deactivates the URL
Secure connection error	Records an error without retries
Any other code	Records an error without retries

Important

A 404 response turns off the URL entirely: no further events are sent to it until you activate it.

How to resend failed deliveries

1. Expand the Webhooks panel and find the “Recent webhook errors” block.
2. Check the event's address and response code, and fix your program if needed.
3. Click “Resend” next to the event.

The block shows failed deliveries for the whole company group; the “Load more” button loads earlier ones. You can resend only an event in error status and only to an active URL: if the URL is deactivated, activate it first.

How to manage a URL

A saved URL has icons:

• “Update webhook URL” — save a changed address, events or toggles;
• “Deactivate webhook URL” — temporarily stop sending events;
• “Activate webhook URL” — turn sending back on;
• “Delete webhook URL” — delete the URL along with its event history, after confirmation.