Authentication and security
API keys
Send your key in the Authorization header of every request:
Authorization: Bearer pxt_test_1a2B3c4D5e6F7g8H9i0J1k2L3m4N5o6P7q8R9s0T| Prefix | Environment | What it does |
|---|---|---|
pxt_test_ | Sandbox | Real prices and validation; bookings stay in the sandbox (TEST- references), are never fulfilled or charged. |
pxt_live_ | Production | Real bookings, fulfilled by our operations team and invoiced according to your agreement. |
Create and revoke keys yourself under Dashboard → API keys. A key is shown once when it is created; we only store a hash, so we cannot show it again. You can have up to 10 active keys — use a separate key per server or environment so you can rotate one without downtime.
Important: API keys must only be used from your servers. Never put a key in a website, a mobile app or a public code repository. If a key may have leaked, revoke it immediately and create a new one.
Errors you may see
| HTTP | error.code | Meaning |
|---|---|---|
| 401 | unauthorized | Missing, malformed or revoked key. |
| 403 | forbidden | Your account is not active, or a live key is used before go-live approval. |
| 403 | ip_not_allowed | The request came from an IP address that is not registered for your account. The message and error.details.ip show the address we saw. |
| 429 | rate_limited | Too many failed authentication attempts from your IP. Wait a minute. |
IP allowlist
Requests are accepted only from the IP addresses registered for your account, even with a valid key. Live keys never work without registered addresses.
- Send us your server IP addresses (IPv4 or IPv6) or IPv4 ranges (at most
/16, for example203.0.113.10, 198.51.100.0/24) under Questions. We add them and you see them under Dashboard → API keys. - During development we can open your test keys to any address, so you can work from laptops and use the console. Live keys always stay limited to the registered addresses.
- Tell us before your servers or their outgoing IP addresses change.
Transport security
- The API is served over HTTPS only. Plain HTTP is redirected and must not be used.
- Requests from browsers are not supported (no CORS). Call the API from your back end.
- Store webhook signing secrets the same way as API keys.