Authentication

Travelyzer Places API uses a secure authentication system based on JWT (JSON Web Token) tokens. This guide walks you through setting up your API access step by step.

Process Overview

Authentication takes place in 3 simple steps:

1. Create your credentials in the Developer Dashboard
2. Exchange your credentials for a JWT token
3. Use the token in your API requests

Step 1: Create Your API Credentials

Access the Dashboard

1. Go to the Developer Dashboard
2. Log in or create an account
3. Navigate to the "API Keys" section

Generate a New Key

1. Click on "Create new key"
2. Give your key a descriptive name (e.g., "Production", "Mobile App", "Backend Server")
3. Click "Create"

Your Credentials

After creation, you receive two essential pieces of information:

Step 2: Get a JWT Token

Use your credentials to obtain a JWT token via the /api-clients/token endpoint.

Endpoint

POST https://api2.gotravelyzer.com/api-clients/token

Request

curl -X POST "https://api2.gotravelyzer.com/api-clients/token" \
  -H "Content-Type: application/json" \
  -d '{
    "apiKey": "gck_your_api_key",
    "apiSecret": "gcs_your_api_secret"
  }'

Body Parameters

Duration Options (expiresIn)

Response (200 OK)

{
  "token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...",
  "expiresAt": "2026-02-24T12:00:00.000Z",
  "clientId": "client_abc123"
}

Possible Errors

Step 3: Use the Token in Your Requests

Include your JWT token in the Authorization header of each API request.

Header Format

Authorization: Bearer your_jwt_token

Request Example

curl "https://places.gotravelyzer.com/v1/geocoding/forward?query=Paris" \
  -H "Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9..."

Complete Example

Here's the complete flow, from obtaining the token to the API call:

# 1. Get a JWT token
TOKEN=$(curl -s -X POST "https://api2.gotravelyzer.com/api-clients/token" \
  -H "Content-Type: application/json" \
  -d '{
    "apiKey": "gck_your_api_key",
    "apiSecret": "gcs_your_api_secret"
  }' | jq -r '.token')
 
# 2. Use the token for a geocoding request
curl "https://places.gotravelyzer.com/v1/geocoding/forward?query=Eiffel%20Tower%20Paris" \
  -H "Authorization: Bearer $TOKEN"

Handling Expired Tokens

Detecting an Expired Token

When your token expires, the API returns a 401 error:

{
  "statusCode": 401,
  "error": "Unauthorized",
  "message": "Token expired"
}

Renewal Strategy

1. Store the expiration date (expiresAt) when obtaining the token
2. Check before each request if the token is close to expiration
3. Proactively renew the token a few minutes before expiration
4. On 401 error, request a new token and retry the request

Security Best Practices

Never Expose Your Credentials

Use environment variables:

# .env (do not commit this file)
TRAVELYZER_API_KEY=gck_your_api_key
TRAVELYZER_API_SECRET=gcs_your_api_secret

# .gitignore
.env
.env.local
.env.production

Client vs Server Security

Secret Rotation

Regularly renew your API Secrets:

1. Create a new secret in the Dashboard
2. Update your applications with the new secret
3. Verify everything works
4. Delete the old secret

Keys by Environment

Use distinct API keys for each environment:

This allows you to:

• Track usage by environment
• Revoke a key without impacting others
• Apply different restrictions

Authentication Errors

Error Response Example

{
  "statusCode": 401,
  "error": "Unauthorized",
  "message": "Invalid token"
}

Next Steps