API keys

The booking API reads trips, departures and destinations without a key, the same things your booking pages show. A key adds two things an open request can't have:

• Draft trips, so your website can show a preview of a trip before you publish it.
• A count of requests, so you can see which website or server calls and how often, when each one uses its own key.

With GraphQL, a key also tells Travel Orbit which organisation to read, so you don't need ?organisation=.

Open API keys from Developers in the sidebar. Everyone can see the list. Only admins can create, rename and revoke keys.

Create a key

1. Choose New key.
2. Give it a name that says where it is used, such as northwilds.com, preview.
3. Under Expires, choose Never, In 30 days, In 90 days or In a year. A key for a live website usually never expires.
4. Switch on Read drafts only for a preview of your website.
5. Choose Create key, then copy the key straight away.

The key is shown once. Travel Orbit stores only a hash of it, so it can't show it to you again; the list shows its first 12 characters, such as trv_pk_Ab3d…, so you can tell keys apart. If a key is lost, revoke it and create another.

Two kinds of key

With a trv_sk_ key, the trips and one trip endpoints also return draft trips, marked with "draft": true. Answers with drafts are never cached.

Send the key

Send the key in a header, either way:

Authorization: Bearer trv_pk_…X-Api-Key: trv_pk_…

For example, a preview build on your server:

1const response = await fetch("https://app.bifrostorbit.com/travel/api/public/northwilds/trips", {2  headers: { Authorization: `Bearer ${process.env.TRAVEL_ORBIT_KEY}` },3});4const { data } = await response.json();

A key that is wrong, revoked, expired or belongs to another organisation gets 401, even on reads that need no key, so a mistake doesn't go unnoticed. The message says which, such as 'This API key has been revoked. Create a new one under API keys in Travel Orbit.'

Revoke and remove

Choose ⋯ next to a key, then Revoke. It stops working on its next request and can't be switched back on. A revoked key can then be removed with Remove; Undo brings it back for a few seconds. A key must be revoked before it can be removed. Rename changes only the name: the key keeps working. Every change is in the audit trail.

Reads shows Published or Drafts. Requests, 30 days counts the requests each key made in the last 30 days. Last used shows the day of the latest one, or Never.

Try a key

In the API playground, choose Add a key at the top and paste a key. Requests then run with it, and the curl and JavaScript you copy include it.