Authentication

API Key Authentication

The Charter Boats API uses API keys to authenticate requests. Include your API key in the X-API-Key header with every request.

curl https://charter.boats/api/boats \
  -H "X-API-Key: cb_live_abc123..."

Any registered user can generate an API key from the dashboard:

Your API key will look like: cb_live_ followed by 32 characters.

If your key is compromised, you can regenerate it from the same settings page. This will immediately invalidate your old key.

Never expose your API key in client-side code, public repositories, or anywhere it could be accessed by unauthorized parties.

Do	Don't
Store API keys in environment variables	Commit API keys to version control
Use server-side code to make API calls	Include keys in client-side JavaScript
Rotate keys periodically	Share keys across different applications
Use different keys for dev and production

Returned when the API key is missing or invalid:

{
  "statusCode": 401,
  "message": "API key required. Include X-API-Key header."
}

{
  "statusCode": 401,
  "message": "Invalid API key"
}