> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://wt.hhr.systems/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://wt.hhr.systems/_mcp/server.

# Authentication

You can authenticate in two ways: an API key, or a JWT from the OAuth password grant. Pick one. Both go in the request headers.

## API key

Send your key in the `x-api-key` header on every request.

```bash
curl -X POST https://api.sar.worldticket.cloud/ota/v2015b/OTA \
  -H "x-api-key: YOUR_API_KEY" \
  -H "local-name: OTA_ReadRQ" \
  -H "Content-Type: application/json" \
  -d '{ ... }'
```

Keep your key on the server. Never ship it in a browser or a mobile app, where anyone could read it and make requests as you.

## JWT (OAuth password grant)

Ask the auth service for a token with the password grant, then send it as a bearer token.

```bash
curl -X POST https://api.sar.worldticket.cloud/auth \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -d "grant_type=password" \
  -d "client_id=YOUR_CLIENT_ID" \
  -d "username=YOUR_USERNAME" \
  -d "password=YOUR_PASSWORD"
```

The response gives you an access token and a refresh token. Send the access token on each API call:

```bash
curl -X POST https://api.sar.worldticket.cloud/ota/v2015b/OTA \
  -H "Authorization: Bearer YOUR_ACCESS_TOKEN" \
  -H "local-name: OTA_ReadRQ" \
  -H "Content-Type: application/json" \
  -d '{ ... }'
```

The access token expires after about two hours. Before it does, use the refresh token to get a new one instead of sending the password again.

```bash
curl -X POST https://api.sar.worldticket.cloud/auth \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -d "grant_type=refresh_token" \
  -d "client_id=YOUR_CLIENT_ID" \
  -d "refresh_token=YOUR_REFRESH_TOKEN"
```

The test auth service lives at `https://test-auth.worldticket.net/auth`. For the exact token payload and client setup, see the [GO7 docs](https://go7-worldticket.github.io/docs/ota/OTA_API_SAR.html).