All guides
Beginner guide
Quickstart: your first call
Issue a key, whitelist your server, send two headers and call ping.
Developer Relations 3 min readAir Travel API, Hotel API, eSIM API, Airport Transfer API
1. Get a key
In the agent portal, open API access and issue a sandbox key. The secret is shown once; store it server-side only.
2. Whitelist your server
A key only works from the public IP addresses you add under API access. Never call the API from a browser or mobile app.
Live keys are switched on after certification, which is run on the sandbox.
3. Send two headers on every request
No login call, no token.
Call ping first
curl "https://sandbox.flightota.com/api/v1/ping" \
-H "X-Api-Key: ak_test_your_key_id" \
-H "X-Api-Secret: <your secret>" \
-H "Accept: application/json"4. Read the answer
Ping tells you which agency and key you are, and the IP we saw, which is the address to whitelist if you get a 403.
GET /ping
{
"ok": true,
"partner": "PTR-000020",
"key_id": "ak_test_your_key_id",
"environment": "test",
"from_ip": "203.0.113.10",
"server_time": "2026-09-22T13:25:02+00:00"
}