Authentication and Scopes

Your organization id

Every organization has a stable organization_id. It appears on every supplier, trip, and webhook payload the API returns, so multi-org integrations can route each response to the right organization in their own systems. Fetch it anytime (with any valid key, no scope required):

curl https://api.travelmode.ai/v1/partner/organization \
  -H "Authorization: Bearer tm_trips_your_key_here"

The response also carries your organization's name, status, plan, environment, and the key's scopes — useful as a connectivity check.

Organization API keys

Your marketplace is a travelmode developer organization. The Travelmode team issues organization API keys with the tm_trips_ prefix; the plaintext is shown exactly once at issuance and only a SHA-256 hash is stored.

Send the key on every request:

Authorization: Bearer tm_trips_...

There is no x-api-key fallback — the documented header is the only accepted form, so logs, SDKs, and gateway rules behave the same everywhere.

Scopes

Scopes are enforced per endpoint; a key missing the required scope gets a 403 scope_required error naming the missing scope. Trips scopes and Weather scopes never satisfy each other — weather:admin does not grant trips:*, and vice versa.

Environments

Keys carry an environment (test or production), reflected in the meta.environment field of every response and in usage reporting.

Rate limits

Requests count against your organization's monthly plan quota. Every response carries the X-RateLimit-Limit, X-RateLimit-Remaining, and X-RateLimit-Reset headers; exceeding the quota returns 429 rate_limited.