# Punndi.com — Flight Search + Holiday Packages (Travelpayouts Data API)

## What's included
- `index.html` — Punndi.com multicolour homepage and flight form
- `assets/punndi-logo.png` — your uploaded Punndi logo
- `api/flight-prices.php` — server-side Travelpayouts Flight Data API proxy
- `config/travelpayouts.php` — private API token and currency settings
- `storage/flight-cache/` — server-side cache to reduce API calls

## Connect your Travelpayouts account

1. In Travelpayouts, open your Profile and find the **API token** section. Copy the token for the Aviasales / Flight Data API.
2. Open `config/travelpayouts.php` on your hosting account.
3. Replace `PASTE_YOUR_TRAVELPAYOUTS_DATA_API_TOKEN_HERE` with your token. Keep the quotes.
4. Save and upload the complete folder to a PHP-enabled host. The website needs PHP 7.4+ (PHP 8+ recommended), cURL enabled, and write permission for `storage/flight-cache/`.
5. Open `https://your-domain/` and search a route using 3-letter IATA codes, e.g. DEL → BOM.
6. The first request fetches the month matrix from Travelpayouts; subsequent requests for the same route/month use the local 20-minute cache.

## Important API behaviour
- This integration uses the **Aviasales Flight Data API**, specifically `/v2/prices/month-matrix`.
- It returns cached/indicative fares gathered from previous searches, not live inventory or guaranteed bookable prices. The data is suitable for price discovery and inspiration; users must verify current availability before purchase.
- The form uses the selected departure month to request a month matrix. It does not guarantee an exact-date match and does not perform ticket booking.
- Currency defaults to INR. Change `currency` in `config/travelpayouts.php` if your account/API setup requires another supported currency.
- The API token stays in PHP on the server; it is never sent to browser JavaScript.
- `show_to_affiliates=true` requests prices associated with partner-marker searches, as recommended in the API docs. This endpoint itself is data-only; it does not create a booking link.

## Troubleshooting
- **Token message:** confirm the token is copied correctly into `config/travelpayouts.php`.
- **cURL disabled:** enable PHP cURL in your hosting control panel or ask your host.
- **No fares:** try a busier route/month; cached data can be sparse.
- **403/401 or provider error:** check that your account token has Flight Data API access and contact Travelpayouts support if needed.
- **500 cache directory error:** make `storage/flight-cache/` writable by PHP (usually 755/775 depending on host). Do not make `config/` publicly readable.

## Local testing
Do not open `index.html` directly as a file. Run it through PHP, for example with XAMPP:
- Put the folder in `htdocs/punndi`
- Start Apache
- Open `http://localhost/punndi/`

The Travelpayouts API may reject requests from localhost depending on account/API rules. For an end-to-end test, deploy to your public domain with HTTPS.

## Security
Do not send your API token in chat, email, screenshots, or public Git repositories. Keep `config/` and `storage/` blocked from direct web access (the included `.htaccess` files do this on Apache). For Nginx, configure equivalent deny rules.
