Keys and environments
One API key on every /v1 call, and the two hosts you can send it to.
Every product on this site sits behind one gateway. You send the same API key to all of them, and the gateway works out who you are from it.
Send your key
Put your key in the x-api-key header on every /v1 request:
curl "$BASE_URL/v1/hotel/places?query=Dubai%20Marina" \
-H "x-api-key: $API_KEY"If your HTTP client only speaks bearer auth, send the same key as Authorization: Bearer $API_KEY instead. Both are accepted on every endpoint.
Keys are issued and revoked from the TrustPixel dashboard. Keep them on your server: anyone holding a key can spend on your account.
Do not send identity headers
The gateway derives your user and organization from the key on every call. Headers such as x-user-id or x-org-id are stripped before the request reaches a service, so sending them changes nothing.
Hosts
| Environment | Base URL |
|---|---|
| Sandbox | https://api.sandbox.oex.sh |
| Production | https://api.oex.sh |
The API reference's Try it panel calls the sandbox by default. Every sample in these guides uses $BASE_URL and $API_KEY, so you can set them once:
export BASE_URL=https://api.sandbox.oex.sh
export API_KEY=… # from the dashboardWhen the key is wrong
A missing, invalid, expired or revoked key gets a 401 before the request reaches any service:
{ "error": { "code": "UnauthenticatedError", "message": "Authentication required." } }Every other error comes from the service you called, in that service's own envelope. Each product's errors page lists its codes and what to do next.