Guides

Authentication

Sign every request with an API key or a JWT
View as Markdown

You can authenticate in two ways: an API key, or a JWT from the OAuth password grant. Pick one. Both go in the request headers.

API key

Send your key in the x-api-key header on every request.

$curl -X POST https://api.sar.worldticket.cloud/ota/v2015b/OTA \
>  -H "x-api-key: YOUR_API_KEY" \
>  -H "local-name: OTA_ReadRQ" \
>  -H "Content-Type: application/json" \
>  -d '{ ... }'

Keep your key on the server. Never ship it in a browser or a mobile app, where anyone could read it and make requests as you.

JWT (OAuth password grant)

Ask the auth service for a token with the password grant, then send it as a bearer token.

$curl -X POST https://api.sar.worldticket.cloud/auth \
>  -H "Content-Type: application/x-www-form-urlencoded" \
>  -d "grant_type=password" \
>  -d "client_id=YOUR_CLIENT_ID" \
>  -d "username=YOUR_USERNAME" \
>  -d "password=YOUR_PASSWORD"

The response gives you an access token and a refresh token. Send the access token on each API call:

$curl -X POST https://api.sar.worldticket.cloud/ota/v2015b/OTA \
>  -H "Authorization: Bearer YOUR_ACCESS_TOKEN" \
>  -H "local-name: OTA_ReadRQ" \
>  -H "Content-Type: application/json" \
>  -d '{ ... }'

The access token expires after about two hours. Before it does, use the refresh token to get a new one instead of sending the password again.

$curl -X POST https://api.sar.worldticket.cloud/auth \
>  -H "Content-Type: application/x-www-form-urlencoded" \
>  -d "grant_type=refresh_token" \
>  -d "client_id=YOUR_CLIENT_ID" \
>  -d "refresh_token=YOUR_REFRESH_TOKEN"

The test auth service lives at https://test-auth.worldticket.net/auth. For the exact token payload and client setup, see the GO7 docs.