Configuration reference · Staylah Connectivity API

config/connectivity.php. Nothing partner-specific belongs here — credentials live in connectivity_credentials so that onboarding a partner is an operations action, not a deploy.

Env var	Default	Meaning
`CONNECTIVITY_ENV`	`sandbox`	Which credential environment this deployment accepts. `sandbox` on staging, `production` on live
`CONNECTIVITY_SIGNATURE_TOLERANCE`	`300`	Accepted clock skew, seconds. Every extra second is replay window
`CONNECTIVITY_RATE_LIMIT`	`300`	Authenticated requests/minute, per key
`CONNECTIVITY_RATE_LIMIT_ANON`	`30`	Unauthenticated requests/minute, per IP
`CONNECTIVITY_LOG_ENABLED`	`true`	Write the access log
`CONNECTIVITY_LOG_SUCCESS`	`true`	Log successes too. Set false to keep only failures
`CONNECTIVITY_LOG_RETENTION_DAYS`	`90`	Access log retention
`CONNECTIVITY_QUOTE_TTL`	`900`	How long a quote token's price stands, seconds. Short on purpose — a quote is a statement about live inventory
`CONNECTIVITY_CANCEL_PENALTY_PCT`	`100`	Percentage of the stay total charged for a cancellation after the free-cancellation deadline
`CONNECTIVITY_NO_SHOW_PCT`	`100`	Percentage charged when the cancellation arrives on or after the arrival date
`CONNECTIVITY_CANCEL_CUTOFF_HOURS`	`24`	Free-cancellation window used when the rate plan carries no cut-off of its own

The three cancellation figures are commercial terms held as configuration, and they are currently ONE number for every property and every rate plan. Staylah has no per-rate-plan penalty schedule: a rate plan carries a cut-off (cut_off_days / cut_off_hours / cut_off_minutes, falling back to rate_plan_lists.cod) and nothing else, so the policy quoted to partners is derived — free until the cut-off, CONNECTIVITY_CANCEL_PENALTY_PCT after it. That is a real limitation rather than a design, and it is the piece to replace first when a per-plan schedule lands. Changing these values is safe for existing bookings: the policy is snapshotted onto each one at creation, so a change only affects bookings made afterwards.

Key generation: 12-byte key id (24 hex chars after the prefix), 32-byte secret (64 hex chars), 32-byte signing secret. Prefixes slk_test_ / slk_live_ make a leaked key recognisable in a log and say which environment it belongs to without a database lookup.