Authentication
Secure your API requests with key-based authentication.
⚠
Keep your API key secure
Never expose API keys in client-side code, public repositories, or URLs. Treat your key like a password.
Obtaining an API Key
- Contact hello@jets.partners with your company name and use case
- Complete the client registration process
- Receive your API key (prefixed with
jtp_) - Store securely in environment variables
Authentication Methods
RECOMMENDED
Bearer Token
curl -H "Authorization: Bearer jtp_your_api_key" \
https://booking.api.jets.partners/api/airports/search?q=ParisX-API-Key Header
curl -H "X-API-Key: jtp_your_api_key" \
https://booking.api.jets.partners/api/airports/search?q=ParisPermissions
| Permission | Endpoints | Description |
|---|---|---|
read | All GET endpoints | Search airports, view account info, usage stats |
write | All POST endpoints | Quoting, empty legs search |
Rate Limiting
Rate limit information is included in response headers:
| Header | Description |
|---|---|
| X-RateLimit-Limit | Maximum requests per window |
| X-RateLimit-Remaining | Remaining requests in current window |
| X-RateLimit-Reset | Unix timestamp when the window resets |
Security Best Practices
Use Environment Variables
Store API keys in env vars, never hardcode in source files.
Rotate Keys Regularly
Generate new keys periodically and revoke old ones.
HTTPS Only
All requests must use HTTPS. HTTP requests are rejected.
Monitor Usage
Check your usage dashboard for unexpected activity patterns.
Authentication Errors
| Code | Status | Description |
|---|---|---|
| MISSING_API_KEY | 401 | No API key provided in request |
| INVALID_API_KEY | 401 | API key is invalid or revoked |
| INSUFFICIENT_PERMISSIONS | 403 | Key lacks required permissions |
| RATE_LIMIT_EXCEEDED | 429 | Too many requests in time window |