Authentication and API Keys

Every request needs an API key in the Authorization header:

curl https://eazygo.in/api/agent/v1/wallet \
  -H "Authorization: Bearer $EAZYGO_API_KEY" \
  -H "Accept: application/json"

Getting a key

1. EazyGo enables API access for your agency. Until then the API answers API_DISABLED.
2. The agency owner logs in to the agent panel and opens API Access.
3. New API Key: give it a name (e.g. "Website booking engine") and choose the login it books as.
4. Copy the key. It is shown only once. EazyGo stores only a hash of it and can't show it again. If a key is lost, revoke it and create a new one.

Keep keys on your server. Never put them in a mobile app, in browser JavaScript or in a public repository.

Which login a key books as

Each key belongs to one login of your agency: the owner or a staff member. That login's permissions apply:

• Bookings made with the key are recorded as booked by that login, as on the agent panel.
• The owner's key, and the keys of supervisors and accounts staff, see every booking of the agency. A booking executive's key sees only the bookings that person made.
• Booking executives can cancel only their own bookings, and only while cancelling is free. Accounts staff can't book or cancel. Booking executives get an empty documents list and can't download invoices.
• If the owner set a spending limit for the login (per booking or per day), a booking over it is refused with SPENDING_LIMIT_EXCEEDED.
• When the owner removes a staff member from the team, that person's keys stop working at once.

Extra protection

• Allowed IPs. Limit a key to your server's public IP addresses. Requests from other addresses are refused with IP_NOT_ALLOWED.
• Expiry. A key can expire after 30, 90, 180 or 365 days. An expired key answers AUTH_REQUIRED.
• Revoking. Revoke a key on the API Access page. It stops working immediately.

Rate limits

Going over a limit returns HTTP 429 with error RATE_LIMITED and a Retry-After header with the seconds to wait.

Agency status

• If EazyGo suspends your agency, you can still read bookings and the wallet, but new bookings are refused with AGENCY_NOT_ACTIVE.
• If EazyGo switches the API off, every key is refused with API_DISABLED and webhooks stop.