Authentication and API Keys

Every request needs an API key in the Authorization header:

curl https://eazygo.in/api/agent/v1/wallet \
  -H "Authorization: Bearer $EAZYGO_API_KEY" \
  -H "Accept: application/json"

Getting a key

1. EazyGo enables API access for your agency. Until then the API answers API_DISABLED.
2. The agency owner logs in to the agent panel and opens API Access.
3. New API Key: give it a name (e.g. "Website booking engine") and choose the login it books as.
4. Copy the key. It is shown only once. EazyGo stores only a hash of it and can't show it again. If a key is lost, revoke it and create a new one.

Keep keys on your server. Never put them in a mobile app, in browser JavaScript or in a public repository.

Which login a key books as

Each key belongs to one login of your agency: the owner or a staff member. That login's permissions apply:

• Bookings made with the key are recorded as booked by that login, as on the agent panel.
• A staff member's key sees only the bookings made by that staff member.
• The owner's key sees every booking of the agency.
• When the owner removes a staff member from the team, that person's keys stop working at once.

Extra protection

• Allowed IPs. Limit a key to your server's public IP addresses. Requests from other addresses are refused with IP_NOT_ALLOWED.
• Expiry. A key can expire after 30, 90, 180 or 365 days. An expired key answers AUTH_REQUIRED.
• Revoking. Revoke a key on the API Access page. It stops working immediately.

Rate limits

Going over a limit returns HTTP 429 with error RATE_LIMITED and a Retry-After header with the seconds to wait.

Agency status

• If EazyGo suspends your agency, you can still read bookings and the wallet, but new bookings are refused with AGENCY_NOT_ACTIVE.
• If EazyGo switches the API off, every key is refused with API_DISABLED and webhooks stop.