Skip to main content

Authentication

Every Agency API request is authenticated with a single header:

Authorization: Bearer <your-api-key>

This is the same header shape as a JWT bearer token — the value is your raw API key, not a JSON Web Token. Send it exactly like this on every request; there is no separate signing step.

Example​

curl -X POST https://api.ondgo.ng/flights/api/v1/FlightBooking/Search \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "tenantId": "<airline-tenant-id>",
    "originDestinations": [
      {"departureAirport": "LOS", "arrivalAirport": "ABV", "departureDate": "2026-12-01"}
    ],
    "passengers": [{"type": "ADLT", "quantity": 1}]
  }'

Legacy header pair​

An older integration style is also accepted, using two separate headers instead of the Authorization header:

XApiKey: <your-api-key>
XClientKey: <your-client-key>

New integrations should prefer the Authorization: Bearer form above — it's simpler and is the form documented throughout this site's API Reference.

What identifies you​

Your API key identifies your tenant and its wallet — you never need to (and can't) specify which wallet a booking should debit. Every request is automatically scoped to your own tenant's wallet.

Your key may also be scoped to a subset of endpoints. A request to an endpoint outside your key's scopes returns 403 Forbidden.

Next step​

Continue to Sandbox vs. production before making a real, money-moving request.