Bienvenue dans Travelandz API

Base et authentification

Configurez les URLs de base, les headers requis et l'authentification par API key pour vos intégrations Travelandz.

Configurez les URLs de base, les headers requis et l'authentification par API key pour vos intégrations Travelandz.

Required headers

HeaderValue
AuthorizationBearer <secret_key>
X-Travelandz-Id<public_key>:<profile_code>
Content-Typeapplication/json for requests with JSON body

Authentication flow

  1. The API token strategy reads Authorization and X-Travelandz-Id.
  2. The bearer token must match the encrypted secret stored for the selected credential.
  3. X-Travelandz-Id must include the public key and a valid Developer Profile code (profileCode, formatted as dp_<12 alphanumeric>). The legacy Mongo ObjectId format is no longer accepted.
  4. Sandbox uses testCredentials; production uses liveCredentials.
  5. The profile and company must be active.
  6. Production requires isProductionAllowed=true.
  7. If domainsAllowed is configured, the request IP, Origin hostname or Referer hostname must match.
  8. The used credential receives lastUsed and the request context stores profileId, profileCode, profileKey, credentialId and companyId.

Credential fields

FieldDescription
profileCodeDeveloper Profile code sent in X-Travelandz-Id, for example dp_a1b2c3d4e5f6. Find it in your dashboard.
credentialIdEmbedded credential _id, used for request log auditability.
publicKeyPublic identifier sent in X-Travelandz-Id, for example pk_sandbox_abc123.
secretKeySecret bearer token. Never store it client-side and never log it.
secretKeyLast4Last four visible characters for user identification.
domainsAllowedOptional IP or hostname allow-list.
lastUsedLast successful usage timestamp.