Cangooroo's API relies on the usage of a combination between Credentials and Token to both authenticate and authorize Requests to access our resources.
As explained before, Credentials for Cangooroo's API must be generated by the Operator who owns the Cangooroo's instance that you're trying to consume and they usually come in the form of an UserName and a Password.
A Token is an automatically generated encripted value that will be connected to a single Availability Response, independent of the Service searched. For example, if you make a Request to our SearchAvailability method for the Hotel service, with the Response you will receive a Token. An unique String that you will have to store and use on the next steps since your Availability Response (the rates, dates and etc.) is bound by your Credentials and Token.
Is important to be aware that a token expires after 30 minutes, giving you a limited window to confirm a Booking after you made your search.