Langsung ke konten utama
Semua Artikel
OperationsJul 19, 2026

Booking widget or booking API: how to take bookings on your own website

A booking widget is a ready-made booking form from your booking provider that you add to your website with a snippet of code. A booking API lets your developers build the booking experience themselves, calling the provider's system to check availability and create bookings. A widget is quicker to launch and the provider maintains it. An API gives you full control of design and flow, and you take on the build and the upkeep.

There is also a middle route, where your developers build your own pages with the provider's front-end SDK and hand the guest to the provider's booking flow for the booking steps and payment. For venues with a developer, this is often the best fit.

What is a booking widget?

A widget is usually a script or an iframe that loads the provider's booking flow inside your page, or a button that opens it. The provider handles availability, payment, confirmation emails and changes to the booking. You choose colours, logo and some wording within the settings it offers.

For a single site without a developer, a widget is usually the sensible starting point. The trade-offs are that the flow looks and behaves like the provider's product, design control stops at the available settings, and analytics can need extra setup when the flow runs inside an iframe.

What is a booking API?

An API exposes the provider's data and actions to your code: list services, check availability for a date and party size, create or change a booking, look up a customer. Your developers design every screen and call the API behind it. That allows things a widget can't do, such as booking steps inside your own app, availability shown on a menu or event page, or a flow that combines several services in your own design.

With an API you own the code. You maintain it when the API changes, handle edge cases such as a slot being taken between viewing and confirming, and decide how payments are collected securely. Keep server API keys on the server and out of browser code.

What is the middle option between a widget and an API?

The middle option is a front-end SDK: a code package that runs on your website and talks to the provider for you. Your developers build the pages, account areas and sign-in in your own design, and the SDK hands the guest to the provider's booking flow, either embedded in your page or opened for the option they chose. Some SDKs also return services, prices and availability as data, so you can build your own browsing pages from live information. The provider handles the booking steps, payment and confirmation, so checkout stays with the system that processes the booking.

How do Tiquo's website booking options work?

Tiquo covers each of these routes. At the widget end, every Tiquo customer flow (the set of booking steps a guest goes through when they book themselves) has its own hosted page URL and embed code. You can link to the hosted page, embed the flow on your website or share a branded link, and guests see the services connected to that flow. Booking flows can collect a deposit or full payment as part of the booking. The customer portal is the other no-code option: a branded portal hosted by Tiquo where customers can book services against live availability, see their upcoming bookings and update their details.

For account features on a site built without code, the hosted package is a script copied from Settings > Website SDK into your site's head, or added through a Webflow or Framer embed block. It works on Webflow, Framer, WordPress, Wix or plain HTML without a build step, and Tiquo manages its updates. Data attributes in your markup display login forms, customer details, orders, bookings and wallet cards, and the page updates when a customer signs in or out.

For custom builds, the npm package @tiquo/dom-package gives developers passwordless sign-in with a one-time code sent by email, plus the customer's profile, orders and upcoming bookings for account pages. Its createEnquiry() method sends an enquiry from your own form into Tiquo, matching or creating the customer by email. The package can also embed a Tiquo customer flow in your page. Sign-in is shared across the customer portal, customer flows and the package, so a guest who has signed in on your site isn't asked to sign in again when they book.

That is how the middle route works with Tiquo: your developers build the pages and account areas around the booking, and the embedded Tiquo flow runs availability, the booking steps and payment.

For back-end work, the Admin API gives your server access to your organisation's Tiquo data, using API keys created under Settings > API. Its documented endpoints cover customers, companies, orders and bookings, which suits keeping Tiquo in step with a CRM, finance tool or other back-office system. Keep those keys on the server and out of browser code. Guest-facing booking pages belong in the customer flows and website packages.

Booking widget, SDK or API: which should you choose?

Booking widgetSDK with provider checkoutFull API build
Developer timeLittle or noneModerateMost
Design controlProvider's settingsYour own pages, provider's checkoutFull
Who maintains itProviderSharedYou
PaymentsHandled in the provider's flowHandled in the provider's flowYou decide how they are collected
Best forSingle sites and quick launchesBranded sites with a developerCustom apps and multi-service flows
In TiquoCustomer flow hosted page or embed code, or the customer portal@tiquo/dom-package on your own pages, with an embedded customer flowAdmin API for server-side integrations

Start with a widget or the provider's hosted booking page unless you have a specific reason not to: a design it can't match, a booking flow that spans several services, or an app. Move to an SDK when you want your own pages without owning checkout. Build against an API when bookings are part of a wider product you already maintain.

Online ordering raises the same choice between a provider's hosted pages and your own build, and our guide to taking collection orders through your own restaurant website covers that side. Hotels weighing up a booking engine alongside a PMS and channel manager can start with our explainer on what each of the three does.

© 2026 Tiquo. "Tiquo" dan logo Tiquo adalah merek dagang terdaftar dari Tiquo Ltd.

GDPR · CCPA · PCI DSS · ICO · Cyber Essentials Certified · EU–US DPF · SOC 2 Type II (in progress) · ISO 27001 (in progress)

Security & Operational

  • 99.99% SLA Uptime
  • AES-256 encryption at rest
  • TLS 1.3 in transit
  • AES-256 / TLS 1.3
  • Perfect Forward Secrecy (PFS)
  • HTTP Strict Transport Security (HSTS)
  • 99.999999999% (11 nines) data durability
  • Automated backups
  • DDoS protection
  • Web Application Firewall (WAF)
  • Zero Trust posture
  • Role-Based Access Control (RBAC)
  • Principle of Least Privilege
  • Secret scanning in CI
  • SBOM generation
  • Dependency supply-chain controls
  • 24/7 infrastructure monitoring
  • GDPR Article 22 safeguards
  • Data Protection Impact Assessments (DPIAs)
  • Records of Processing Activities (ROPA)
  • SAML 2.0 SSO
  • EASIE SSO
  • OAuth 2.0 / OpenID Connect (OIDC)
  • SCIM 2.0 provisioning
  • MFA / 2FA enforcement
  • Responsible disclosure / bug bounty programme

Privacy, Data Protection & Statutory Obligations

  • ICO Registered
  • UK Modern Slavery Act 2015 compliant
  • UK Public Interest Disclosure Act 1998 compliant
  • EU Article 27 Representative appointed (Paris, France)
  • Swiss FADP Article 14 Representative appointed
  • UK GDPR compliant
  • EU GDPR/DSGVO compliant
  • UK Data Protection Act 2018 compliant
  • Swiss revFADP compliant
  • CCPA / CPRA compliant (California)
  • VCDPA compliant (Virginia)
  • CPA compliant (Colorado)
  • CTDPA compliant (Connecticut)
  • TDPSA compliant (Texas)
  • OCPA compliant (Oregon)
  • MCDPA compliant (Montana)
  • FDBR compliant (Florida)
  • ICDPA compliant (Iowa)
  • ICDPA compliant (Indiana)
  • TIPA compliant (Tennessee)
  • DPDPA compliant (Delaware)
  • NJDPA compliant (New Jersey)
  • NHDPA compliant (New Hampshire)
  • NDPA compliant (Nebraska)
  • MCDPA compliant (Minnesota)
  • MODPA compliant (Maryland)
  • KCDPA compliant (Kentucky)
  • RIDTPPA compliant (Rhode Island)
  • Canada PIPEDA compliant
  • Quebec Law 25 compliant
  • Alberta PIPA compliant
  • British Columbia PIPA compliant
  • Singapore PDPA compliant
  • Hong Kong PDPO compliant
  • Brazil LGPD compliant
  • Japan APPI compliant
  • Australia Privacy Act / APPs compliant
  • India DPDPA 2023 compliant
  • Thailand PDPA compliant
  • Malaysia PDPA 2010 (as amended 2024) compliant
  • New Zealand Privacy Act 2020 compliant
  • South Africa POPIA compliant
  • UAE PDPL compliant
  • Mexico LFPDPPP compliant
  • Kenya Data Protection Act 2019 compliant
  • Ghana Data Protection Act 2012 compliant
  • Nigeria NDPA 2023 compliant
  • Indonesia PDP Law 2022 compliant
  • Philippines Data Privacy Act 2012 compliant

Global Fiscal & E-Invoicing

  • EN 16931 - EU e-invoicing core standard
  • UBL 2.1 - Universal Business Language
  • Austria - RKSV
  • Belgium - Peppol BIS 3.0 (B2B)
  • Czechia - fiscalization
  • Croatia - Fiscalization 2.0
  • Denmark - Peppol BIS 3.0 (B2B)
  • France - NF525 / LNE / Infocert, Factur-X / PDP, E-Reporting
  • Germany - KassenSichV / TSE, DSFinV-K, GoBD, E-Rechnung B2B (XRechnung / ZUGFeRD)
  • Hungary - Online Szamla
  • Italy - Scontrino, FatturaPA (via SDI)
  • Lithuania - i.SAF / i.MAS
  • Norway - Peppol BIS 3.0 (B2B), SAF-T
  • Poland - KSeF
  • Portugal - ATCUD/QR, SAF-T PT
  • Slovakia - eKasa
  • Slovenia - fiscalization (davcno potrjevanje)
  • Spain - FacturaE, SII, VeriFactu, TicketBAI
  • Sweden - SKVFS (certified cash registers)
  • Argentina - ARCA (Q4 2026)
  • Australia - Peppol PINT A-NZ (Q4 2026)
  • Brazil - NFe, NFCe, NFSe (Q4 2026)
  • Chile - SII Chile (Q4 2026)
  • Colombia - DIAN (Q4 2026)
  • Finland - Finvoice, TEAPPSXML (Q4 2026)
  • Japan - JP PINT (Peppol) (Q3 2026)
  • Malaysia - Peppol Malaysia (Q4 2026)
  • Mexico - CFDI (Q4 2026)
  • New Zealand - Peppol PINT A-NZ (Q4 2026)
  • Peru - SUNAT (Q4 2026)
  • Romania - Peppol (RO e-invoice) (Q4 2026)
  • Saudi Arabia - ZATCA (Q4 2026)
  • Singapore - Peppol BIS 3.0 (Q4 2026)
  • United Arab Emirates - Peppol (5C) (Q4 2026)

Standards & Frameworks

  • Cyber Essentials Certified
  • SOC 2 Type II - audit in progress
  • ISO/IEC 27001 - audit in progress
  • NIST Cybersecurity Framework - aligned
  • NIST Privacy Framework - aligned
  • NIST SP 800-53 / 800-63 / 800-63B - aligned
  • NIST AI Risk Management Framework - aligned
  • CIS Critical Security Controls / CIS Benchmarks - aligned
  • OWASP ASVS & OWASP Top Ten - aligned
  • ISO 25010 (quality) - aligned
  • ISO 31000 (risk) - aligned
  • ITIL - aligned
  • W3C Web Standards - aligned
  • OpenAPI Standard - aligned
  • DevSecOps practices - aligned
  • ePrivacy Directive - aligned
  • EU Whistleblowing Directive (2019/1937) - aligned

Payments Compliance

  • PCI DSS Level 1
  • PSD2 / Strong Customer Authentication
  • 3D Secure (3DS)
  • EMVCo Level 1 & 2
  • AML / KYC controls
  • Sanctions screening (OFAC, UN, EU, HMT)

International Data Transfer Mechanisms

  • EU-US Data Privacy Framework
  • EU Standard Contractual Clauses (Decision 2021/914) - Modules 2 & 3
  • UK International Data Transfer Agreement (IDTA) + ICO Addendum
  • Swiss FDPIC-recognised transfer mechanisms
  • APEC Cross-Border Privacy Rules (CBPR)

Accessibility Compliance

  • ADA (Americans with Disabilities Act) - aligned
  • European Accessibility Act (EAA) 2025 - aligned
  • WCAG 2.2 - aligned
  • EN 301 549 - aligned
  • WAI-ARIA - aligned

Satu platform untuk hotel, spa, kelas, acara, restoran, dan lainnya.

Tiquo Ltd
London, Inggris

LinkedInTop Performer Spring

Kami menggunakan cookie

Pilih apakah Anda mengizinkan cookie untuk analitik dan iklan. Anda dapat menerima atau menolaknya. Menutup pemberitahuan ini berarti menolak cookie tersebut.

Pelajari lebih lanjut