# API keys

> Create keys for the booking API and GraphQL to preview draft trips on your website and to see which website calls and how often. Reading works without one.

Source: https://docs.bifrostorbit.com/travel/developers/api-keys/

The [booking API](https://docs.bifrostorbit.com/travel/developers/booking-api/) reads trips, departures and destinations without a key, the same things your booking pages show. A key adds two things an open request can't have:

- **Draft trips**, so your website can show a preview of a trip before you publish it.
- **A count of requests**, so you can see which website or server calls and how often, when each one uses its own key.

With [GraphQL](https://docs.bifrostorbit.com/travel/developers/graphql/), a key also tells Travel Orbit which organisation to read, so you don't need `?organisation=`.

Open **API keys** from **Developers** in the sidebar. Everyone can see the list. Only admins can create, rename and revoke keys.

## Create a key

1. Choose **New key**.
2. Give it a name that says where it is used, such as `northwilds.com, preview`.
3. Under **Expires**, choose **Never**, **In 30 days**, **In 90 days** or **In a year**. A key for a live website usually never expires.
4. Switch on **Read drafts** only for a preview of your website.
5. Choose **Create key**, then copy the key straight away.

The key is shown once. Travel Orbit stores only a hash of it, so it can't show it to you again; the list shows its first 12 characters, such as `trv_pk_Ab3d…`, so you can tell keys apart. If a key is lost, revoke it and create another.

## Two kinds of key

| Starts with | Reads | Where to use it |
| --- | --- | --- |
| `trv_pk_` | What anyone can read | A website or a server |
| `trv_sk_` | Draft trips too | Your server only. Travel Orbit refuses it from a browser on another website, with `403`. |

With a `trv_sk_` key, the trips and one trip endpoints also return draft trips, marked with `"draft": true`. Answers with drafts are never cached.

## Send the key

Send the key in a header, either way:

```
Authorization: Bearer trv_pk_…
X-Api-Key: trv_pk_…
```

For example, a preview build on your server:

```js
const response = await fetch("https://app.bifrostorbit.com/travel/api/public/northwilds/trips", {
  headers: { Authorization: `Bearer ${process.env.TRAVEL_ORBIT_KEY}` },
});
const { data } = await response.json();
```

A key that is wrong, revoked, expired or belongs to another organisation gets `401`, even on reads that need no key, so a mistake doesn't go unnoticed. The message says which, such as 'This API key has been revoked. Create a new one under API keys in Travel Orbit.'

## Revoke and remove

Choose **⋯** next to a key, then **Revoke**. It stops working on its next request and can't be switched back on. A revoked key can then be removed with **Remove**; **Undo** brings it back for a few seconds. A key must be revoked before it can be removed. **Rename** changes only the name: the key keeps working. Every change is in the [audit trail](https://docs.bifrostorbit.com/travel/everyone/audit-trail/).

**Reads** shows **Published** or **Drafts**. **Requests, 30 days** counts the requests each key made in the last 30 days. **Last used** shows the day of the latest one, or **Never**.

## Try a key

In the [API playground](https://docs.bifrostorbit.com/travel/developers/api-playground/), choose **Add a key** at the top and paste a key. Requests then run with it, and the curl and JavaScript you copy include it.