API Key Management

The Dashboard allows you to create and manage your API credentials to access Travelyzer Places API. This page explains the complete process, from creation to usage.

Understanding Credentials

Each API key includes three elements:

Creating an API Key

Steps

1. Go to Dashboard > API Keys
2. Click "Create new key"
3. Configure the key:
   • Name: Descriptive identifier (e.g., "Production", "Mobile App", "Backend")
   • Description: (Optional) Additional notes
4. Click "Create"
5. Copy immediately the API Key and API Secret

Creation Window

After creation, a window displays your credentials:

╭──────────────────────────────────────────────────────╮
│  ✅ API Key created successfully                     │
│                                                      │
│  Client ID:                                          │
│  client_mlxy7tuphn77ug                               │
│                                                      │
│  API Key:                                            │
│  gck_a1b2c3d4e5f6g7h8i9j0k1l2                       │
│                                                      │
│  API Secret:                                         │
│  gcs_x1y2z3a4b5c6d7e8f9g0h1i2j3k4l5m6n7o8p9q0      │
│                                                      │
│  ⚠️ Copy the secret now, it will not be shown       │
│     again after closing this window.                 │
│                                                      │
│  [Copy API Key]  [Copy API Secret]  [Close]          │
╰──────────────────────────────────────────────────────╯

Using Your Credentials

Authentication Flow

1. Create credentials    →  Dashboard > API Keys
       ↓
2. Get JWT token         →  POST /api-clients/token
       ↓
3. Call the API          →  Authorization: Bearer <token>

Get a JWT Token

Use your credentials to obtain a token:

curl -X POST "https://api2.gotravelyzer.com/api-clients/token" \
  -H "Content-Type: application/json" \
  -d '{
    "apiKey": "gck_your_api_key",
    "apiSecret": "gcs_your_api_secret",
    "expiresIn": "24h"
  }'

Response:

{
  "token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...",
  "expiresAt": "2026-02-24T12:00:00.000Z",
  "clientId": "client_mlxy7tuphn77ug"
}

Use the Token

curl "https://places.gotravelyzer.com/v1/geocoding/forward?query=Paris" \
  -H "Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9..."

Managing Existing Keys

Key List

The table displays for each key:

Available Actions

Regenerating the Secret

If you think your secret has been compromised, or if you've lost it:

1. Go to Dashboard > API Keys
2. Click on the ⋮ (three dots) of the relevant key
3. Select "Regenerate secret"
4. Confirm the action
5. Copy the new secret

Statistics by Key

For each key, access detailed statistics:

Available Metrics

Distribution by Endpoint

/v1/geocoding/forward       ████████████████████ 85%
/v1/geocoding/reverse       ███ 10%
/v1/geocoding/autocomplete  █ 4%
/v1/geocoding/batch         ▌ 1%

Usage Graph

Visualize usage over 7, 30, or 90 days.

Key Rotation

Why Rotate?

• Security: Limit the impact of a compromised key
• Compliance: Meet security policies
• Best practices: Regular rotation recommended (every 90 days)

Rotation Process

1. Create a new key with a temporary name (e.g., "Production-v2")
2. Update your applications with the new credentials
3. Verify that the new key works correctly
4. Delete the old key once migration is confirmed
5. Rename the new key if necessary

Best Practices

Secret Security

# .env (do not commit this file)
TRAVELYZER_API_KEY=gck_your_api_key
TRAVELYZER_API_SECRET=gcs_your_api_secret

# .gitignore
.env
.env.local
.env.production
*.secret

One Key per Environment

Descriptive Naming

Use clear names to easily identify your keys:

• ✅ production-backend-v1
• ✅ mobile-app-ios
• ✅ staging-frontend
• ❌ test123
• ❌ my_key

Limits by Plan

Frequently Asked Questions

I lost my API Secret, what should I do?

Use the "Regenerate secret" function in the Dashboard. A new secret will be generated and the old one will be invalidated.

Can I have multiple keys?

Yes, you can create multiple keys according to your plan. It's recommended to separate environments (dev, staging, production).

How long does a JWT token last?

By default, 1 hour. You can configure the duration when generating the token (expiresIn: "1h", "24h", "7d", "30d").

Can a key be shared between multiple applications?

Technically yes, but it's not recommended. Use a distinct key per application to:

• Isolate statistics
• Facilitate rotation
• Limit the impact of a compromise

Next Steps