Skip to main content

Generate an API key

After your integration is enabled, generate credentials from the API Access tab in your OnDgo account dashboard.

What you get​

The dashboard returns two values, shown once:

  • API Key — the credential you send on every request.
  • Client Key — used only by the legacy header pair (see below); most integrations won't need this.

:::danger Shown once, never re-displayed Store both values securely as soon as they're generated. If you lose them, generate a new key — the old one cannot be recovered or re-displayed. :::

Scopes​

Keys can be scoped to search, price, book, cancel, and webhooks. A request outside the key's scopes returns 403 Forbidden; the credential is valid, but not authorized for that action.

Holding more than one key​

You can keep several active keys at once. This supports:

  • Graceful rotation: generate a new key, switch your integration over, then revoke the old one once you've confirmed the new one works — no gap in service.
  • Scoped keys per system: e.g. a search-only key for a read-only integration, and a separate book+cancel key for the system that actually makes purchases.

Revoking a key​

Revoke a key from the API Access tab when it is no longer needed or may be compromised. Revocation is immediate and does not affect your other keys.

Next step​

Continue to Authentication to make your first authenticated request.