Password-Protected Site Access (`id` + `sig`)

If your Whitelabel site is password-protected, visitors normally see a login screen before they can browse. You can skip that screen by appending signed query parameters (id and sig) to any deep link.

This is useful when you want to send this to closed user group and want to send them straight into hotel search, hotel details, checkout, or another Whitelabel page.

Note: This unlocks the site password only. It is not guest SSO / customer account login. For guest SSO, follow this guide - https://docs.liteapi.travel/update/docs/single-sign-on-deep-link-guide

Prerequisites

Enable password protection for the Whitelabel in Backoffice.
Use the project’s LiteAPI key as the HMAC secret when generating sig.

Without password protection enabled, id and sig are ignored and the page loads normally.

Parameters

Parameter	Description	Example
`id`	Arbitrary string you choose (for example a session id, timestamp, or partner reference). This value is the message that gets signed.	`partner-1735680000`
`sig`	HMAC-SHA256 of `id`, using your LiteAPI key as the secret, encoded as a lowercase hex string.	`a3f2c9e1…`

Both parameters must be present and valid. An invalid sig returns 401 Unauthorized.

How to generate `sig`

Algorithm

sig = HMAC-SHA256(key = LITEAPI_KEY, message = id) → hex digest

Node.js

const crypto = require('crypto');

const liteApiKey = process.env.LITEAPI_KEY; // your project LiteAPI key
const id = `partner-${Date.now()}`; // any unique string you choose

const sig = crypto
  .createHmac('sha256', liteApiKey)
  .update(id)
  .digest('hex');

const url = `https://wl-domain/hotels?id=${encodeURIComponent(id)}&sig=${sig}`;
console.log(url);

OpenSSL (shell)

ID="partner-$(date +%s)"
SIG=$(printf '%s' "$ID" | openssl dgst -sha256 -hmac "$LITEAPI_KEY" | awk '{print $2}')

echo "https://wl-domain/hotels?id=${ID}&sig=${SIG}"

Example URLs

You can add id and sig to any supported deep-link URL. Keep your existing search, hotel, or checkout parameters and append the signed pair.

Home / entry

https://wl-domain/?id=partner-1735680000&sig=YOUR_HEX_SIGNATURE

Hotel listing

https://wl-domain/hotels?placeId=ChIJgUbEo8cfqokR5lP9_Wh_DaM&checkin=2024-09-15&checkout=2024-09-20&id=partner-1735680000&sig=YOUR_HEX_SIGNATURE

Hotel details

https://wl-domain/hotels/lp4aa75?checkin=2024-09-15&checkout=2024-09-20&id=partner-1735680000&sig=YOUR_HEX_SIGNATURE

Checkout

https://wl-domain/booking?offerId=abc123xyz&id=partner-1735680000&sig=YOUR_HEX_SIGNATURE

What happens on a valid link

The user opens the URL with id and sig.
The Whitelabel verifies that sig matches HMAC-SHA256(LiteAPI key, id).
On success, the site marks the browser as authenticated for password-protected access.
The browser is redirected to the same path with id and sig removed from the query string (other parameters such as placeId, checkin, offerId, language, and currency remain).
The user continues into the deep-linked page without seeing the site password screen.

Notes & best practices

Treat your LiteAPI key as a secret. Anyone who can generate a valid sig can bypass the site password.
Prefer a unique id per link (timestamp, UUID, or partner session reference), even though the server only checks that sig matches id.
Do not log or store full signed URLs in analytics, support tickets, or client-side code that is publicly visible.
You can still append generic deep-link parameters such as language, currency, clientReference, and xData.
Invalid or tampered sig values return 401.
If password protection is disabled on the project, id / sig have no effect.