Authentication

API Key Authentication

The Charter Boats API uses API keys to authenticate requests. Include your API key in the X-API-Key header with every request.

curl https://charter.boats/api/import/boat \
  -H "X-API-Key: cb_live_abc123..."

Boat owners can generate their own API key directly from the dashboard:

Your API key will look like: cb_live_ followed by 32 characters.

API keys are only available for boat owners. List at least one boat to get access.

If your key is compromised, you can regenerate it from the same settings page. This will immediately invalidate your old key.

Never expose your API key in client-side code, public repositories, or anywhere it could be accessed by unauthorized parties.

Do	Don't
Store API keys in environment variables	Commit API keys to version control
Use server-side code to make API calls	Include keys in client-side JavaScript
Rotate keys periodically	Share keys across different applications
Use different keys for dev and production

If you need higher limits, contact us at api@charter.boats.

Missing or invalid API key:

{
  "statusCode": 401,
  "message": "API key required. Include X-API-Key header."
}

{
  "statusCode": 401,
  "message": "Invalid API key"
}

Rate limit exceeded:

{
  "statusCode": 429,
  "message": "Rate limit exceeded. Please retry after 60 seconds."
}