Handle frequent flyer and loyalty program numbers correctly in booking APIs

Steps

1. Collect the loyalty program code (airline IATA code or program identifier, e.g. 'BA' for British Airways Executive Club) and the member number as separate fields — do not concatenate them.
2. Pass loyalty numbers in the traveler or passenger object of the booking API — in Amadeus this is travelers[].loyaltyPrograms[], in Duffel it is passengers[].loyalty_programme_accounts[]; check API docs for the exact field names and validation rules.
3. Validate the member number format client-side if the program publishes a format (e.g. numeric-only, specific length) before submitting; an invalid format will cause a booking API validation error that is hard to debug post-submission.
4. Loyalty accrual on codeshare flights follows the operating carrier's program rules, not the marketing carrier's — a passenger flying on a BA-operated flight booked under an IB codeshare accrues Avios under BA's partner earn rates; document this for users.
5. Some airlines allow loyalty number to be added post-booking via a 'manage booking' flow rather than requiring it at booking time — if the booking API rejects an invalid loyalty number, offer to proceed without it and add it later.
6. Never store loyalty program passwords or security questions — only the program code and member number are needed for mileage accrual; treat member numbers as PII and store encrypted.