Authentication | Tourism API documentation

Send the key on every request in either of two headers: X-API-Key: your_key, or Authorization: Bearer your_key. Both are read the same way. A key in the address (?key=) is refused with a 400, so keys never land in server logs.

curl https://api.tourismapi.com/v1/countries \
  -H "X-API-Key: $TOURISM_API_KEY"

curl https://api.tourismapi.com/v1/countries \
  -H "Authorization: Bearer $TOURISM_API_KEY"

Prefix	Use
ta_live_	Production calls, counted against your plan
ta_test_	The free key: same shapes, the free endpoints only

To rotate, create a second key in your account, deploy it, then revoke the first. Both work during the overlap. We only ever show the first characters of a key after it is made; the secret itself is never stored in readable form.

Browser code exposes any key it ships with. Call the API from your own server and pass the figures on.