Authentication

Every request to the AirCredit Partner API must carry a partner API key as a bearer token:

Authorization: Bearer sk_live_your_key_here

Keys are issued per API client from the AirCredit console. A key scopes every call to that client: it can only see and act on that client's submissions, uploads, endpoints, and events.

Sending the key

Put the key in the Authorization header on every request. There is no session, no login call, and no token exchange — the key is the credential.

curl https://api.aircredit.de/partner/v1/submissions \
  -H "Authorization: Bearer $AIRCREDIT_API_KEY"

import { createClient } from "@aircredit/partner-sdk";

// The client sets the Authorization header for you on every call.
const client = createClient({ apiKey: process.env.AIRCREDIT_API_KEY! });

import os
from aircredit_partner import Client

client = Client(api_key=os.environ["AIRCREDIT_API_KEY"])

use aircredit_partner::Client;

let client = Client::new_with_api_key(
    "https://api.aircredit.de/partner",
    std::env::var("AIRCREDIT_API_KEY")?,
);

Handling keys safely

• Server-side only. The key grants full access to your API client. Never ship it in a browser bundle, mobile app, or anywhere a partner's end-user could read it. All calls originate from your backend.
• Store it as a secret. Use your platform's secret manager or environment variables — not source control. The examples read AIRCREDIT_API_KEY from the environment for exactly this reason.
• Rotate on suspicion. Keys can be revoked at any time from the console. Because every write is idempotent on your external_* ids, rotating a key mid-flight is safe: retry the in-flight request with the new key and the same external id.
• One key per environment. Use separate API clients (and therefore separate keys) for staging and production so revoking one never disrupts the other.

401 vs 403

The two auth failures mean different things — handle them differently.

A 401 is about the credential; a 403 is about the client or the action. Neither is transient — retrying the identical request will fail the same way. See Errors for the full envelope and every code.

Request correlation

Every response — success or error — carries an x-request-id header, and every error body repeats it as error.request_id. Log it. When you open a support ticket, quoting the request id lets AirCredit find the exact call. You may also send your own x-request-id request header (non-empty, ≤128 chars) and it will be echoed back.