Generate an API key

Once your tenant's API integration has been enabled, generate your key pair from your OnDgo account dashboard's API Access tab.

What you get

Generating a key returns two values, shown once:

• API Key — the credential you send on every request.
• Client Key — used only by the legacy header pair (see below); most integrations won't need this.

:::danger Shown once, never re-displayed Store both values securely as soon as they're generated. If you lose them, generate a new key — the old one cannot be recovered or re-displayed. :::

Scopes

Every key is scoped to the endpoint groups it may call: search, price, book, cancel, webhooks. If you don't specify scopes when generating a key, it gets full access — the same behavior as before scopes existed. A key that calls an endpoint outside its own scopes gets a 403 Forbidden, not a 401 — the key itself is valid, it's just not authorized for that action.

Holding more than one key

Generating a new key does not invalidate your existing ones — you can hold several active keys at once. This is useful for:

• Graceful rotation: generate a new key, switch your integration over, then revoke the old one once you've confirmed the new one works — no gap in service.
• Scoped keys per system: e.g. a search-only key for a read-only integration, and a separate book+cancel key for the system that actually makes purchases.

Revoking a key

Revoke a specific key from the same API Access tab (or POST /RevokeApiKey with the key's id) when it's no longer needed or may have been compromised. Revocation is immediate and per-key — your other keys keep working unaffected.

Next step

Continue to Authentication to make your first authenticated request.