Authentication

Send your key as a bearer token on every request:

curl https://sandbox-api.flyrail.space/v1/ping -H "Authorization: Bearer fr_test_sk_..."

Keys are shown once and stored only as a hash, so we can't show one again. Lost it? Create a new one and revoke the old.

Scopes#

Each key carries scopes. A call without the scope gets 403 missing_scope.

Scope	Allows
search	POST /flights/search, POST /offers/{id}/price
book	POST /bookings
cancel	POST /bookings/{id}/cancel
read	bookings, ticket, wallet, transactions, webhook events

IP allow-lists#

Add the addresses of your servers (or CIDR ranges) to a key. Calls from anywhere else get 403 ip_not_allowed. Strongly recommended for live keys.

Rotating#

Rotate creates a replacement with the same scopes and revokes the old key at once. Deploy the new key first if you can't afford a gap: create a second key, switch over, then revoke the first.